Edit tour

Windows Analysis Report
fdnoqmpv.exe

Overview

General Information

Sample name:	fdnoqmpv.exe
Analysis ID:	1488273
MD5:	a5b50eaa46c9477e60d39778fa662926
SHA1:	ed043f86af11c291b3e508d14fe1c4232aab1842
SHA256:	f4d0a30894abd66615326caa634eeb082e8cc4ced56dab62e9219ac2c28294ca
Tags:	exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

fdnoqmpv.exe (PID: 4536 cmdline: "C:\Users\user\Desktop\fdnoqmpv.exe" MD5: A5B50EAA46C9477E60D39778FA662926)

cmd.exe (PID: 6528 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\miqllcjz\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2952 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\fzzrueiu.exe" C:\Windows\SysWOW64\miqllcjz\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4440 cmdline: "C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 5676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6368 cmdline: "C:\Windows\System32\sc.exe" description miqllcjz "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 1076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1784 cmdline: "C:\Windows\System32\sc.exe" start miqllcjz MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 2284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2584 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6156 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 652 MD5: C31336C1EFC2CCB44B4326EA793040F2)

fzzrueiu.exe (PID: 2640 cmdline: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d"C:\Users\user\Desktop\fdnoqmpv.exe" MD5: 1E259F74EE370BB24432817021F14FAD)

svchost.exe (PID: 1672 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 3292 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 452 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 1276 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 892 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4536 -ip 4536 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5676 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2640 -ip 2640 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2136944010.0000000002B19000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4f7a:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2152720884.0000000002B82000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x520a:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
Process Memory Space: fdnoqmpv.exe PID: 4536	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: fzzrueiu.exe PID: 2640	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 1672	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.fdnoqmpv.exe.2ac0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.fdnoqmpv.exe.2ac0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.fdnoqmpv.exe.2ae0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.fdnoqmpv.exe.2ae0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.fzzrueiu.exe.2b50e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.fzzrueiu.exe.2b50e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.3.fzzrueiu.exe.3160000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.fzzrueiu.exe.3160000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.fdnoqmpv.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.fdnoqmpv.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.fdnoqmpv.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.fdnoqmpv.exe.2ac0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.fdnoqmpv.exe.2ac0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.fdnoqmpv.exe.2ac0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.fzzrueiu.exe.3160000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.3.fzzrueiu.exe.3160000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.fzzrueiu.exe.3160000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.fzzrueiu.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.fzzrueiu.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.fzzrueiu.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.fdnoqmpv.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.fdnoqmpv.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.fdnoqmpv.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.fdnoqmpv.exe.2ae0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.fdnoqmpv.exe.2ae0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.fdnoqmpv.exe.2ae0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.fzzrueiu.exe.2b50e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.fzzrueiu.exe.2b50e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.fzzrueiu.exe.2b50e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.fzzrueiu.exe.31a0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.fzzrueiu.exe.31a0000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.fzzrueiu.exe.31a0000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.fzzrueiu.exe.31a0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.fzzrueiu.exe.31a0000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.fzzrueiu.exe.31a0000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
18.2.svchost.exe.580000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
18.2.svchost.exe.580000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
18.2.svchost.exe.580000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
18.2.svchost.exe.580000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
18.2.svchost.exe.580000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
18.2.svchost.exe.580000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.fzzrueiu.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.fzzrueiu.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.fzzrueiu.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d"C:\Users\user\Desktop\fdnoqmpv.exe", ParentImage: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, ParentProcessId: 2640, ParentProcessName: fzzrueiu.exe, ProcessCommandLine: svchost.exe, ProcessId: 1672, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\fdnoqmpv.exe", ParentImage: C:\Users\user\Desktop\fdnoqmpv.exe, ParentProcessId: 4536, ParentProcessName: fdnoqmpv.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 4440, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.42.0, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 1672, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d"C:\Users\user\Desktop\fdnoqmpv.exe", ParentImage: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, ParentProcessId: 2640, ParentProcessName: fzzrueiu.exe, ProcessCommandLine: svchost.exe, ProcessId: 1672, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 1672, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\miqllcjz

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\fdnoqmpv.exe", ParentImage: C:\Users\user\Desktop\fdnoqmpv.exe, ParentProcessId: 4536, ParentProcessName: fdnoqmpv.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 4440, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 1276, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: vanaheim.cn:443	Avira URL Cloud: Label: phishing
Source: jotunheim.name:443	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.fdnoqmpv.exe.400000.0.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for submitted file

Source: fdnoqmpv.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\fzzrueiu.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: fdnoqmpv.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Unpacked PE file: 0.2.fdnoqmpv.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Unpacked PE file: 12.2.fzzrueiu.exe.400000.0.unpack

Source: C:\Users\user\Desktop\fdnoqmpv.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\miqllcjz

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.94 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 74.125.206.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.42.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.226.112.95 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.42.0 52.101.42.0
Source: Joe Sandbox View	IP Address: 67.195.228.94 67.195.228.94
Source: Joe Sandbox View	IP Address: 94.100.180.31 94.100.180.31

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: YAHOO-GQ1US YAHOO-GQ1US
Source: Joe Sandbox View	ASN Name: RETN-ASEU RETN-ASEU
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU

Source: global traffic	TCP traffic: 192.168.2.5:49706 -> 52.101.42.0:25
Source: global traffic	TCP traffic: 192.168.2.5:61066 -> 67.195.228.94:25
Source: global traffic	TCP traffic: 192.168.2.5:61067 -> 74.125.206.27:25
Source: global traffic	TCP traffic: 192.168.2.5:61070 -> 94.100.180.31:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61073
Source: unknown	Network traffic detected: HTTP traffic on port 61068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 61073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61068

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 0.2.fdnoqmpv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fdnoqmpv.exe.2ac0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.fzzrueiu.exe.3160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fdnoqmpv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fdnoqmpv.exe.2ae0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.2b50e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.31a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.31a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fdnoqmpv.exe PID: 4536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fzzrueiu.exe PID: 2640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1672, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.fdnoqmpv.exe.2ac0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.fdnoqmpv.exe.2ac0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.fdnoqmpv.exe.2ae0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.fdnoqmpv.exe.2ae0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.fzzrueiu.exe.2b50e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.fzzrueiu.exe.2b50e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.fzzrueiu.exe.3160000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.fzzrueiu.exe.3160000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.fdnoqmpv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.fdnoqmpv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.fdnoqmpv.exe.2ac0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.fdnoqmpv.exe.2ac0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.fzzrueiu.exe.3160000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.fzzrueiu.exe.3160000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.fzzrueiu.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.fzzrueiu.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.fdnoqmpv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.fdnoqmpv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.fdnoqmpv.exe.2ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.fdnoqmpv.exe.2ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.fzzrueiu.exe.2b50e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.fzzrueiu.exe.2b50e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.fzzrueiu.exe.31a0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.fzzrueiu.exe.31a0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.fzzrueiu.exe.31a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.fzzrueiu.exe.31a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 18.2.svchost.exe.580000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 18.2.svchost.exe.580000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 18.2.svchost.exe.580000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 18.2.svchost.exe.580000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.fzzrueiu.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.fzzrueiu.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2136944010.0000000002B19000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2152720884.0000000002B82000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\miqllcjz\

Jump to behavior

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Code function: 12_2_0040C913	12_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_0058C913	18_2_0058C913

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Code function: String function: 02AC27AB appears 35 times
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Windows\System32\conhost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4536 -ip 4536

Source: fdnoqmpv.exe, 00000000.00000000.2072668625.000000000282C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOdilesigo: vs fdnoqmpv.exe
Source: fdnoqmpv.exe, 00000000.00000002.2136968604.0000000002B7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesOdilesigo: vs fdnoqmpv.exe
Source: fdnoqmpv.exe	Binary or memory string: OriginalFilenamesOdilesigo: vs fdnoqmpv.exe

Source: 0.2.fdnoqmpv.exe.2ac0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.fdnoqmpv.exe.2ac0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.fdnoqmpv.exe.2ae0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.fdnoqmpv.exe.2ae0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.fzzrueiu.exe.2b50e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.fzzrueiu.exe.2b50e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.fzzrueiu.exe.3160000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.fzzrueiu.exe.3160000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.fdnoqmpv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.fdnoqmpv.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.fdnoqmpv.exe.2ac0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.fdnoqmpv.exe.2ac0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.fzzrueiu.exe.3160000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.fzzrueiu.exe.3160000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.fzzrueiu.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.fzzrueiu.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.fdnoqmpv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.fdnoqmpv.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.fdnoqmpv.exe.2ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.fdnoqmpv.exe.2ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.fzzrueiu.exe.2b50e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.fzzrueiu.exe.2b50e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.fzzrueiu.exe.31a0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.fzzrueiu.exe.31a0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.fzzrueiu.exe.31a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.fzzrueiu.exe.31a0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 18.2.svchost.exe.580000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 18.2.svchost.exe.580000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 18.2.svchost.exe.580000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 18.2.svchost.exe.580000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.fzzrueiu.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.fzzrueiu.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2136944010.0000000002B19000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2152720884.0000000002B82000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.evad.winEXE@31/3@9/5

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_02B1DFA8 CreateToolhelp32Snapshot,Module32First,

0_2_02B1DFA8

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_00589A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	18_2_00589A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5676:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:892:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5676:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1276:120:WilError_03

Source: C:\Users\user\Desktop\fdnoqmpv.exe

File created: C:\Users\user\AppData\Local\Temp\fzzrueiu.exe

Jump to behavior

Source: C:\Users\user\Desktop\fdnoqmpv.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: fdnoqmpv.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\fdnoqmpv.exe

File read: C:\Users\user\Desktop\fdnoqmpv.exe

Jump to behavior

Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_12-15053

Source: unknown	Process created: C:\Users\user\Desktop\fdnoqmpv.exe "C:\Users\user\Desktop\fdnoqmpv.exe"
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\miqllcjz\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\fzzrueiu.exe" C:\Windows\SysWOW64\miqllcjz\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description miqllcjz "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start miqllcjz
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d"C:\Users\user\Desktop\fdnoqmpv.exe"
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4536 -ip 4536
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 652
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2640 -ip 2640
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 452
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\miqllcjz\	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\fzzrueiu.exe" C:\Windows\SysWOW64\miqllcjz\	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description miqllcjz "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start miqllcjz	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4536 -ip 4536	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 652	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2640 -ip 2640	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 452	Jump to behavior

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: fdnoqmpv.exe

Static file information: File size 13641216 > 1048576

Source: C:\Users\user\Desktop\fdnoqmpv.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Unpacked PE file: 0.2.fdnoqmpv.exe.400000.0.unpack .text:ER;.data:W;.xevaj:R;.zac:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Unpacked PE file: 12.2.fzzrueiu.exe.400000.0.unpack .text:ER;.data:W;.xevaj:R;.zac:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Unpacked PE file: 0.2.fdnoqmpv.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Unpacked PE file: 12.2.fzzrueiu.exe.400000.0.unpack

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Code function: 0_2_02B21290 push 0000002Bh; iretd		0_2_02B21296
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Code function: 12_2_02B8A520 push 0000002Bh; iretd		12_2_02B8A526

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe

Source: C:\Users\user\Desktop\fdnoqmpv.exe	File created: C:\Users\user\AppData\Local\Temp\fzzrueiu.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\miqllcjz

Jump to behavior

Source: C:\Users\user\Desktop\fdnoqmpv.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\fdnoqmpv.exe

Jump to behavior

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

18_2_0058199C

Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-15921
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15294
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_18-6457

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_18-6139

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_18-7321
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-15286
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-15428

Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_12-15068
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-14857

Source: C:\Users\user\Desktop\fdnoqmpv.exe	API coverage: 5.4 %
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	API coverage: 3.9 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 2820	Thread sleep count: 33 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 2820	Thread sleep time: -33000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000012.00000002.3312771989.0000000002C00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe

API call chain: ExitProcess graph end node

graph_18-6430

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_18-7490
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_12-16445

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Code function: 0_2_02AC0D90 mov eax, dword ptr fs:[00000030h]	0_2_02AC0D90
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Code function: 0_2_02AC092B mov eax, dword ptr fs:[00000030h]	0_2_02AC092B
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Code function: 0_2_02B1D885 push dword ptr fs:[00000030h]	0_2_02B1D885
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Code function: 12_2_02B50D90 mov eax, dword ptr fs:[00000030h]	12_2_02B50D90
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Code function: 12_2_02B5092B mov eax, dword ptr fs:[00000030h]	12_2_02B5092B
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Code function: 12_2_02B86B15 push dword ptr fs:[00000030h]	12_2_02B86B15

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_00589A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	18_2_00589A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.94 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 74.125.206.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.42.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.226.112.95 443	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 580000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 580000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 580000			Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2952008			Jump to behavior

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\miqllcjz\	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\fzzrueiu.exe" C:\Windows\SysWOW64\miqllcjz\	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description miqllcjz "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start miqllcjz	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4536 -ip 4536	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 652	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2640 -ip 2640	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 452	Jump to behavior

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fdnoqmpv.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\fdnoqmpv.exe

0_2_00407809

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\fdnoqmpv.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 0.2.fdnoqmpv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fdnoqmpv.exe.2ac0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.fzzrueiu.exe.3160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fdnoqmpv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fdnoqmpv.exe.2ae0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.2b50e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.31a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.31a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fdnoqmpv.exe PID: 4536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fzzrueiu.exe PID: 2640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1672, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 0.2.fdnoqmpv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fdnoqmpv.exe.2ac0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.fzzrueiu.exe.3160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fdnoqmpv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fdnoqmpv.exe.2ae0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.2b50e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.31a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.31a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.fzzrueiu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fdnoqmpv.exe PID: 4536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fzzrueiu.exe PID: 2640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1672, type: MEMORYSTR

Source: C:\Users\user\Desktop\fdnoqmpv.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe	Code function: 12_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_005888B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	18_2_005888B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	2 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
fdnoqmpv.exe	47%	ReversingLabs	Win32.Trojan.BotX
fdnoqmpv.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\fzzrueiu.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
vanaheim.cn:443	100%	Avira URL Cloud	phishing
jotunheim.name:443	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mxs.mail.ru	94.100.180.31	true	true	unknown
mta5.am0.yahoodns.net	67.195.228.94	true	true	unknown
microsoft-com.mail.protection.outlook.com	52.101.42.0	true	true	unknown
vanaheim.cn	213.226.112.95	true	true	unknown
smtp.google.com	74.125.206.27	true	false	unknown
google.com	unknown	unknown	true	unknown
yahoo.com	unknown	unknown	true	unknown
mail.ru	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	Avira URL Cloud: phishing	unknown
jotunheim.name:443	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.101.42.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
67.195.228.94	mta5.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	true
213.226.112.95	vanaheim.cn	Russian Federation	9002	RETN-ASEU	true
74.125.206.27	smtp.google.com	United States	15169	GOOGLEUS	false
94.100.180.31	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1488273
Start date and time:	2024-08-05 19:50:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fdnoqmpv.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@31/3@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 62 Number of non-executed functions: 260
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.112.250.133, 20.70.246.20, 20.236.44.162, 20.231.239.246, 20.76.201.171
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: fdnoqmpv.exe

Simulations

Behavior and APIs

Time	Type	Description
13:51:54	API Interceptor	6x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.42.0	.exe	Get hash	malicious	Unknown	Browse
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse
67.195.228.94	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	WtRLqa6ZXn.exe	Get hash	malicious	Unknown	Browse
	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
213.226.112.95	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
94.100.180.31	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
	setup.exe	Get hash	malicious	Tofsee	Browse
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	.exe	Get hash	malicious	Unknown	Browse
	ydbWyoxHsd.exe	Get hash	malicious	Unknown	Browse
	Readme.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mxs.mail.ru	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	setup.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	5CxmQXL0LD.exe	Get hash	malicious	SystemBC	Browse	94.100.180.31
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
mta5.am0.yahoodns.net	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	67.195.204.72
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.74
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.77
	newtpp.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.77
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	67.195.228.109
microsoft-com.mail.protection.outlook.com	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	.exe	Get hash	malicious	Unknown	Browse	52.101.40.26
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	setup.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RETN-ASEU	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	http://baghoorg.xyz	Get hash	malicious	Unknown	Browse	139.45.197.153
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	139.45.197.236
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	139.45.197.236
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	https://ky.codzika.xyz/pubg/	Get hash	malicious	Unknown	Browse	139.45.197.250
	https://plcr.com.ng/atm.php?user=21003&ref=21003	Get hash	malicious	Unknown	Browse	139.45.197.237
	http://becast.onionlive.workers.dev	Get hash	malicious	Unknown	Browse	139.45.197.236
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://www.google.com/aclk?sa=l&ai=DChcSEwiOgc__s96HAxWtIa0GHQSaKnoYABAAGgJwdg&co=1&ase=2&gclid=Cj0KCQjw8MG1BhCoARIsAHxSiQnsGgXsF9N-CTUdvkZ2OgloHU2xKGwSfDGxLDHi9ENt3nSRslGk5Z4aAjQUEALw_wcB&sig=AOD64_30gJrlZCnbDWmeAyph6Mlb_4IJhA&q&nis=4&adurl&ved=2ahUKEwjassj_s96HAxXDLkQIHVr9KdQQ0Qx6BAgtEAE	Get hash	malicious	Unknown	Browse	13.107.246.60
	ATT78758.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	BWISE Solution #24-2000091.pdf	Get hash	malicious	Unknown	Browse	52.146.76.30
	https://www.templatent.com/eur/53d926b2-0373-4a76-8641-e3f5488f632d/768e4d81-78b7-4fd9-a857-c5bae5c87179/8806a07c-707c-445d-b36c-c08aabe89fc9/login?id=eHZ4eG45M1NGWG40b2QvVmpHbE5UdUJZSWtJNTkrbE9YcjlKZERpV1VUZ3Zlbk5sM3MwTWYzMjJ0ZWpYb2VpekdKaCtMclNhd3hFRDdtd2VKSi9HM3M2bDFHRkdDd0YrdW1DNWlqTFQwc1BRd0Y5Q0lDZ0tLdys2RHVCZ2NXemVQUDdZa0laUFJlbFJsTnlkdWZsUHR4SnVUV2pZN3QyNkJXaDJSeEdWN3JJT2hHaUYwd2xqMmJ4Y05kSSsxU0ppVkc5QURXSkJKUlMxNEgvT0FIWUQvWGZFZHBvbFdhcVBXRzQxWnJ3M0RwMElNQkpsaWtXWGRMV3Y1ZHNmREVCMkxVa05HeW1qb1BSRkMrSmxpNS80Z2FWaGtJZWthYXZ6WWtaeGNIWjU5VitKZ1Vzd1pHN0VyOTJqTDFvZUYvTURlWUdvRysxd0dZZjgySXduSXM2enIwWDlmWWsxcTk2L1BvV1dGZERCcUxHazluS0kwRU9oK3lKKzJPeFU1NDRVN2N2ZVhPRHRDb3k2c1ZyTkdlR2YyUT09	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://grace-barr.filemail.com/t/Fc9Dus5d	Get hash	malicious	HTMLPhisher	Browse	52.98.241.162
	001original.eml	Get hash	malicious	Unknown	Browse	104.208.16.91
	Saic Benefits_Enrollment.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	FW Quote.msg	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
	https://thehackernews.com/2024/08/new-android-trojan-blankbot-targets.html	Get hash	malicious	Unknown	Browse	13.107.246.60
YAHOO-GQ1US	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	67.195.228.106
	.exe	Get hash	malicious	Unknown	Browse	67.195.228.84
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	98.137.77.194
	qD7cj0t7Ag.elf	Get hash	malicious	Mirai, Moobot	Browse	98.137.186.234
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	https://yellatism.com/click.php?key=2240o76mk7oyoycyr074&cid=cphbldi9sch0sh7da130&zone=2353135-2517555085-3576986712&campaign=395161020&type=Push&age=11&creative_id=547520&campaign_id=108855&site_id=11517&placement_id=43113822&preset_id=500	Get hash	malicious	Unknown	Browse	98.137.11.164
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	GK9sEyIS4f.elf	Get hash	malicious	Mirai	Browse	98.136.201.234
	n6UMcur8v3.elf	Get hash	malicious	Mirai	Browse	98.137.238.181
MAILRU-ASMailRuRU	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	SecuriteInfo.com.Trojan.Crypt.28917.30010.exe	Get hash	malicious	Unknown	Browse	5.61.236.163
	IISz6QDXkY.elf	Get hash	malicious	Mirai	Browse	5.61.23.77
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	7Y18r(123).exe	Get hash	malicious	Unknown	Browse	94.100.180.106
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	setup.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SecuriteInfo.com.W32.Kryptik.CI.tr.21358.1519.exe	Get hash	malicious	Unknown	Browse	5.61.236.163
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	79.137.247.12

Process:	C:\Users\user\Desktop\fdnoqmpv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15099904
Entropy (8bit):	4.713881987206198
Encrypted:	false
SSDEEP:	24576:jIbasG14OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOn:jItG1
MD5:	1E259F74EE370BB24432817021F14FAD
SHA1:	82C7502372954A04546255CC50AC9BEF7B3BB6B8
SHA-256:	601EB53BE38724E5FE61B937451CC81FC2F41CB7D0C5C08159176CC4689C8538
SHA-512:	045B982383E99BF1B3FD6CEE116E5B5A90832B0E07A90FCAA9A8DE037CEA7B18C68E1E64374E443F8F80DF995CD9CB6AF134DA2719027BED166AEA1EF7DD0AA3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*~TQK..QK..QK..>=..rK..>=..pK..>=...K..X3..VK..QK..-K..>=..PK..>=..PK..>=..PK..RichQK..........PE..L....".d......................A......[............@..........................`C.....Ta.........................................P.....B.............................................................A..@............................................text...0........................... ..`.data...T.?......\|..................@....xevaj........B......0..............@..@.zac..........B......4..............@....rsrc........B..0...8..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15099904
Entropy (8bit):	4.713881987206198
Encrypted:	false
SSDEEP:	24576:jIbasG14OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOn:jItG1
MD5:	1E259F74EE370BB24432817021F14FAD
SHA1:	82C7502372954A04546255CC50AC9BEF7B3BB6B8
SHA-256:	601EB53BE38724E5FE61B937451CC81FC2F41CB7D0C5C08159176CC4689C8538
SHA-512:	045B982383E99BF1B3FD6CEE116E5B5A90832B0E07A90FCAA9A8DE037CEA7B18C68E1E64374E443F8F80DF995CD9CB6AF134DA2719027BED166AEA1EF7DD0AA3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*~TQK..QK..QK..>=..rK..>=..pK..>=...K..X3..VK..QK..-K..>=..PK..>=..PK..>=..PK..RichQK..........PE..L....".d......................A......[............@..........................`C.....Ta.........................................P.....B.............................................................A..@............................................text...0........................... ..`.data...T.?......\|..................@....xevaj........B......0..............@..@.zac..........B......4..............@....rsrc........B..0...8..............@..@........................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.715914873275824
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fdnoqmpv.exe
File size:	13'641'216 bytes
MD5:	a5b50eaa46c9477e60d39778fa662926
SHA1:	ed043f86af11c291b3e508d14fe1c4232aab1842
SHA256:	f4d0a30894abd66615326caa634eeb082e8cc4ced56dab62e9219ac2c28294ca
SHA512:	c5234a621effaaafb46f07542a8ab0991cc580b18555b13e082dfb9a18e19a3fa372cd522a13fbafcad39ad343ca526ccc14ff3e8ccc3dede6e7fca4ed51106f
SSDEEP:	24576:8IbasG14OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOm:8ItG1
TLSH:	A7D6E4503AEDD499E6F24B745974F3ED212BBCABB864825F36643F0B3831746284172E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*~TQK..QK..QK..>=..rK..>=..pK..>=...K..X3..VK..QK..-K..>=..PK..>=..PK..>=..PK..RichQK..........PE..L....".d...................

File Icon


Icon Hash:	cd4d3d2e4e054d07

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 19:51:12.672811031 CEST	49706	25	192.168.2.5	52.101.42.0
Aug 5, 2024 19:51:13.683248043 CEST	49706	25	192.168.2.5	52.101.42.0
Aug 5, 2024 19:51:15.683248997 CEST	49706	25	192.168.2.5	52.101.42.0
Aug 5, 2024 19:51:15.840814114 CEST	49707	443	192.168.2.5	213.226.112.95
Aug 5, 2024 19:51:15.840851068 CEST	443	49707	213.226.112.95	192.168.2.5
Aug 5, 2024 19:51:15.840926886 CEST	49707	443	192.168.2.5	213.226.112.95
Aug 5, 2024 19:51:19.698844910 CEST	49706	25	192.168.2.5	52.101.42.0
Aug 5, 2024 19:51:27.698860884 CEST	49706	25	192.168.2.5	52.101.42.0
Aug 5, 2024 19:51:32.702044964 CEST	61066	25	192.168.2.5	67.195.228.94
Aug 5, 2024 19:51:33.714534044 CEST	61066	25	192.168.2.5	67.195.228.94
Aug 5, 2024 19:51:35.730117083 CEST	61066	25	192.168.2.5	67.195.228.94
Aug 5, 2024 19:51:39.730127096 CEST	61066	25	192.168.2.5	67.195.228.94
Aug 5, 2024 19:51:47.730103970 CEST	61066	25	192.168.2.5	67.195.228.94
Aug 5, 2024 19:51:52.736903906 CEST	61067	25	192.168.2.5	74.125.206.27
Aug 5, 2024 19:51:53.745750904 CEST	61067	25	192.168.2.5	74.125.206.27
Aug 5, 2024 19:51:55.745731115 CEST	61067	25	192.168.2.5	74.125.206.27
Aug 5, 2024 19:51:55.855467081 CEST	49707	443	192.168.2.5	213.226.112.95
Aug 5, 2024 19:51:55.855520010 CEST	443	49707	213.226.112.95	192.168.2.5
Aug 5, 2024 19:51:55.855571032 CEST	49707	443	192.168.2.5	213.226.112.95
Aug 5, 2024 19:51:55.965598106 CEST	61068	443	192.168.2.5	213.226.112.95
Aug 5, 2024 19:51:55.965665102 CEST	443	61068	213.226.112.95	192.168.2.5
Aug 5, 2024 19:51:55.965753078 CEST	61068	443	192.168.2.5	213.226.112.95
Aug 5, 2024 19:51:59.745760918 CEST	61067	25	192.168.2.5	74.125.206.27
Aug 5, 2024 19:52:07.745790958 CEST	61067	25	192.168.2.5	74.125.206.27
Aug 5, 2024 19:52:12.799495935 CEST	61070	25	192.168.2.5	94.100.180.31
Aug 5, 2024 19:52:13.808324099 CEST	61070	25	192.168.2.5	94.100.180.31
Aug 5, 2024 19:52:15.823954105 CEST	61070	25	192.168.2.5	94.100.180.31
Aug 5, 2024 19:52:19.839556932 CEST	61070	25	192.168.2.5	94.100.180.31
Aug 5, 2024 19:52:27.855207920 CEST	61070	25	192.168.2.5	94.100.180.31
Aug 5, 2024 19:52:35.964783907 CEST	61068	443	192.168.2.5	213.226.112.95
Aug 5, 2024 19:52:35.964864016 CEST	443	61068	213.226.112.95	192.168.2.5
Aug 5, 2024 19:52:35.964973927 CEST	61068	443	192.168.2.5	213.226.112.95
Aug 5, 2024 19:52:36.074995995 CEST	61073	443	192.168.2.5	213.226.112.95
Aug 5, 2024 19:52:36.075041056 CEST	443	61073	213.226.112.95	192.168.2.5
Aug 5, 2024 19:52:36.075154066 CEST	61073	443	192.168.2.5	213.226.112.95

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 19:51:12.634207010 CEST	60398	53	192.168.2.5	1.1.1.1
Aug 5, 2024 19:51:12.669277906 CEST	53	60398	1.1.1.1	192.168.2.5
Aug 5, 2024 19:51:15.591161013 CEST	59611	53	192.168.2.5	1.1.1.1
Aug 5, 2024 19:51:15.839437008 CEST	53	59611	1.1.1.1	192.168.2.5
Aug 5, 2024 19:51:24.116043091 CEST	53	65350	1.1.1.1	192.168.2.5
Aug 5, 2024 19:51:32.683901072 CEST	62324	53	192.168.2.5	1.1.1.1
Aug 5, 2024 19:51:32.692687988 CEST	53	62324	1.1.1.1	192.168.2.5
Aug 5, 2024 19:51:32.693479061 CEST	60770	53	192.168.2.5	1.1.1.1
Aug 5, 2024 19:51:32.701368093 CEST	53	60770	1.1.1.1	192.168.2.5
Aug 5, 2024 19:51:52.715020895 CEST	64039	53	192.168.2.5	1.1.1.1
Aug 5, 2024 19:51:52.727070093 CEST	53	64039	1.1.1.1	192.168.2.5
Aug 5, 2024 19:51:52.727668047 CEST	54432	53	192.168.2.5	1.1.1.1
Aug 5, 2024 19:51:52.736361027 CEST	53	54432	1.1.1.1	192.168.2.5
Aug 5, 2024 19:52:12.730691910 CEST	54563	53	192.168.2.5	1.1.1.1
Aug 5, 2024 19:52:12.740214109 CEST	53	54563	1.1.1.1	192.168.2.5
Aug 5, 2024 19:52:12.741060019 CEST	56363	53	192.168.2.5	1.1.1.1
Aug 5, 2024 19:52:12.798780918 CEST	53	56363	1.1.1.1	192.168.2.5
Aug 5, 2024 19:53:09.145962000 CEST	52465	53	192.168.2.5	1.1.1.1
Aug 5, 2024 19:53:09.154371023 CEST	53	52465	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 5, 2024 19:51:12.634207010 CEST	192.168.2.5	1.1.1.1	0x20ae	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:15.591161013 CEST	192.168.2.5	1.1.1.1	0x709e	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:32.683901072 CEST	192.168.2.5	1.1.1.1	0xfd9	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:51:32.693479061 CEST	192.168.2.5	1.1.1.1	0x4689	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:52.715020895 CEST	192.168.2.5	1.1.1.1	0xd14	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:51:52.727668047 CEST	192.168.2.5	1.1.1.1	0xbd07	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:12.730691910 CEST	192.168.2.5	1.1.1.1	0x4367	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:52:12.741060019 CEST	192.168.2.5	1.1.1.1	0x9b02	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:53:09.145962000 CEST	192.168.2.5	1.1.1.1	0xeb14	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 5, 2024 19:51:12.669277906 CEST	1.1.1.1	192.168.2.5	0x20ae	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:12.669277906 CEST	1.1.1.1	192.168.2.5	0x20ae	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:12.669277906 CEST	1.1.1.1	192.168.2.5	0x20ae	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:12.669277906 CEST	1.1.1.1	192.168.2.5	0x20ae	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:15.839437008 CEST	1.1.1.1	192.168.2.5	0x709e	No error (0)	vanaheim.cn	213.226.112.95	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:32.692687988 CEST	1.1.1.1	192.168.2.5	0xfd9	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:51:32.692687988 CEST	1.1.1.1	192.168.2.5	0xfd9	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:51:32.692687988 CEST	1.1.1.1	192.168.2.5	0xfd9	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:51:32.701368093 CEST	1.1.1.1	192.168.2.5	0x4689	No error (0)	mta5.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:32.701368093 CEST	1.1.1.1	192.168.2.5	0x4689	No error (0)	mta5.am0.yahoodns.net	98.136.96.74	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:32.701368093 CEST	1.1.1.1	192.168.2.5	0x4689	No error (0)	mta5.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:32.701368093 CEST	1.1.1.1	192.168.2.5	0x4689	No error (0)	mta5.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:32.701368093 CEST	1.1.1.1	192.168.2.5	0x4689	No error (0)	mta5.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:32.701368093 CEST	1.1.1.1	192.168.2.5	0x4689	No error (0)	mta5.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:32.701368093 CEST	1.1.1.1	192.168.2.5	0x4689	No error (0)	mta5.am0.yahoodns.net	98.136.96.75	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:32.701368093 CEST	1.1.1.1	192.168.2.5	0x4689	No error (0)	mta5.am0.yahoodns.net	67.195.204.79	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:52.727070093 CEST	1.1.1.1	192.168.2.5	0xd14	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:51:52.736361027 CEST	1.1.1.1	192.168.2.5	0xbd07	No error (0)	smtp.google.com	74.125.206.27	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:52.736361027 CEST	1.1.1.1	192.168.2.5	0xbd07	No error (0)	smtp.google.com	64.233.184.27	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:52.736361027 CEST	1.1.1.1	192.168.2.5	0xbd07	No error (0)	smtp.google.com	64.233.167.27	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:52.736361027 CEST	1.1.1.1	192.168.2.5	0xbd07	No error (0)	smtp.google.com	64.233.167.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:51:52.736361027 CEST	1.1.1.1	192.168.2.5	0xbd07	No error (0)	smtp.google.com	74.125.206.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:12.740214109 CEST	1.1.1.1	192.168.2.5	0x4367	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:52:12.798780918 CEST	1.1.1.1	192.168.2.5	0x9b02	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:12.798780918 CEST	1.1.1.1	192.168.2.5	0x9b02	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:53:09.154371023 CEST	1.1.1.1	192.168.2.5	0xeb14	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:53:09.154371023 CEST	1.1.1.1	192.168.2.5	0xeb14	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:53:09.154371023 CEST	1.1.1.1	192.168.2.5	0xeb14	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:53:09.154371023 CEST	1.1.1.1	192.168.2.5	0xeb14	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:51:03
Start date:	05/08/2024
Path:	C:\Users\user\Desktop\fdnoqmpv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fdnoqmpv.exe"
Imagebase:	0x400000
File size:	13'641'216 bytes
MD5 hash:	A5B50EAA46C9477E60D39778FA662926
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2136944010.0000000002B19000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.2096852918.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:51:06
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\miqllcjz\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:51:06
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:51:07
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\fzzrueiu.exe" C:\Windows\SysWOW64\miqllcjz\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:51:07
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:51:07
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create miqllcjz binPath= "C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d\"C:\Users\user\Desktop\fdnoqmpv.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xa00000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:51:07
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:51:08
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description miqllcjz "wifi internet conection"
Imagebase:	0xa00000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:51:08
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:51:08
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start miqllcjz
Imagebase:	0xa00000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:51:08
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:51:09
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe /d"C:\Users\user\Desktop\fdnoqmpv.exe"
Imagebase:	0x400000
File size:	15'099'904 bytes
MD5 hash:	1E259F74EE370BB24432817021F14FAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000003.2149627295.0000000003160000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2152851858.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2152720884.0000000002B82000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:51:09
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:51:09
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:51:09
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:51:09
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4536 -ip 4536
Imagebase:	0xa30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:51:09
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 652
Imagebase:	0xa30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:51:11
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x600000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	13:51:11
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2640 -ip 2640
Imagebase:	0xa30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:51:11
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 452
Imagebase:	0xa30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	31%
Signature Coverage:	25.4%
Total number of Nodes:	1562
Total number of Limit Nodes:	18

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

%X%08X, xrefs: 0040A0B0
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 00409EDB
\, xrefs: 00409D0C
P, xrefs: 00409DAA
", xrefs: 0040A189
D, xrefs: 00409F8E
", xrefs: 0040A078

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 02B1DFA8 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02B1DFD0
Module32First.KERNEL32(00000000,00000224), ref: 02B1DFF0

Memory Dump Source

Source File: 00000000.00000002.2136944010.0000000002B19000.00000040.00000020.00020000.00000000.sdmp, Offset: 02B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b19000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 003690f2f74fb08b4de19db76438740aecb91e4d3f798fae5f41234db94a7513
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 4FF096321007166BD7203BF9988CF6E77E9EF49624F900568E642915C0DB74E9454A61

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 02AC003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02AC024D

Strings

cess, xrefs: 02AC018D
kernel32.dll, xrefs: 02AC008F, 02AC0095

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 77b4f91f235047b03f240085a0b62e3264a2354fde38222ea06cf8f4f096a48e
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: CF526A75A01229DFDB64CF68C984BACBBB1BF09304F1480E9E54DAB351DB30AA95DF14

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 02AC0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02AC0223,?,?), ref: 02AC0E19
SetErrorMode.KERNELBASE(00000000,?,?,02AC0223,?,?), ref: 02AC0E1E

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 8a735869a6528d6606602727038bf9373a82e2c2b859bec44d6c4f97bdc17d1c
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 94D01231145128B7D7003B94DC09BCD7B1CDF05B66F108011FB0DD9080CB7095404AE5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 02B1DC67 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02B1DCB8

Memory Dump Source

Source File: 00000000.00000002.2136944010.0000000002B19000.00000040.00000020.00020000.00000000.sdmp, Offset: 02B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b19000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: cccd54f19bd95910a0c328667e768906a8c0285b461968e788d3715cea6482d9
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 42112B79A00209EFDB01DF98C985E99BBF5AF08351F0580A4F9489B361D371EA50DF80

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
flags_upd, xrefs: 0040CE4A
srv_time, xrefs: 0040CABB
lid_file_upd, xrefs: 0040CE6A
wtm_r, xrefs: 0040C97F
\, xrefs: 0040D3A7
4, xrefs: 0040D9F7
drivers\, xrefs: 0040D067
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
\, xrefs: 0040D39D
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
wtm_c, xrefs: 0040C956
@, xrefs: 0040D754
local_time, xrefs: 0040CACD
wtm_w, xrefs: 0040C96C
.sys, xrefs: 0040D0CC
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

ntdll.dll, xrefs: 0040100D
RtlFreeSid, xrefs: 00401116
NtSetInformationThread, xrefs: 00401155
NtClose, xrefs: 004011B4
NtDuplicateToken, xrefs: 004011F3
NtOpenProcessToken, xrefs: 004011D4
NtFilterToken, xrefs: 0040122B
NtSetInformationToken, xrefs: 00401175
RtlLengthSid, xrefs: 00401246
RtlInitUnicodeString, xrefs: 00401135
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtTerminateProcess, xrefs: 004010F6
RtlSetLastWin32Error, xrefs: 004010D6
RtlNtStatusToDosError, xrefs: 00401194
NtQueryInformationToken, xrefs: 00401262

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Aug, xrefs: 0040B287
Apr, xrefs: 0040B26B
Jun, xrefs: 0040B279
Feb, xrefs: 0040B25D
Wed, xrefs: 0040B23A
Fri, xrefs: 0040B248
Sat, xrefs: 0040B24F
Thu, xrefs: 0040B241
Oct, xrefs: 0040B295
Mar, xrefs: 0040B264
Sep, xrefs: 0040B28E
Jul, xrefs: 0040B280
Jan, xrefs: 0040B256
Nov, xrefs: 0040B29C
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Sun, xrefs: 0040B225
Mon, xrefs: 0040B22C
May, xrefs: 0040B272
Tue, xrefs: 0040B233
Dec, xrefs: 0040B2A3

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

useless, xrefs: 0040161E
%systemroot%\system32\cmd.exe, xrefs: 00401316
@, xrefs: 00401380
wusa.exe, xrefs: 00401388
, xrefs: 00401462
D, xrefs: 004015C6
<, xrefs: 00401378
uac, xrefs: 00401628
PDGu, xrefs: 0040139A

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

start_srv, xrefs: 00401E6C
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
born_date, xrefs: 00401EAD, 00401ECC
IsWow64Process, xrefs: 00401DF2
net_type, xrefs: 00401E87
lid_file_upd, xrefs: 00401E25
kernel32, xrefs: 00401DF7
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
loader_id, xrefs: 00401F4B, 00401F6B
work_srv, xrefs: 00401E5E

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 02AC65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 02AC65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02AC6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02AC6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02AC6652

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 313b01b5694e347194cf80b6a4a92a6330e840efdc6b2a4cc9acd222c507389c
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 63117771600218BFDB119F65DD45F9B3FACEB45BA5F204029FA05D7250DBB1DD008AA4

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 02AC092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 02AC09DC, 02AC09DF, 02AC09E4
., xrefs: 02AC095F
l, xrefs: 02AC0966

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: ba8c12a3e452939846fd921f81fc0805f73b0fcdea2c158ac85d7ace117d28a8
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 203139B6910609DFDB14CF99C880BAEBBF9FF48324F25414AD441AB210DB71EA45CFA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 02B1D885 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2136944010.0000000002B19000.00000040.00000020.00020000.00000000.sdmp, Offset: 02B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b19000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: dd4186705bafbf549dca4e8e6b16e61753ecb35a3262cda571ba8600bf7122bc
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 7211A172740101AFDB44DF55DCD0FA673EAEB88760B6980A5ED08CB319D775E802CBA0

Function 02AC0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 06ad2c2c1f6419307f60a8a3603d4e76a2fe1128416141491a51f16bf6b4cb53
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 2F01A776610704CFDF21CF24C844BAA33E9EB85215F5544A9D50697241EB74A9418F90

Function 02AC9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02AC9E6D
lstrcpy.KERNEL32(?,00000000), ref: 02AC9FE1
lstrcat.KERNEL32(?,?), ref: 02AC9FF2
lstrcat.KERNEL32(?,0041070C), ref: 02ACA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 02ACA054
DeleteFileA.KERNEL32(?), ref: 02ACA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02ACA0D6
lstrcpy.KERNEL32 ref: 02ACA12F
lstrlen.KERNEL32(00000022), ref: 02ACA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 02AC9F13

Part of subcall function 02AC7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 02AC7081

Part of subcall function 02AC6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\jfniizgw,02AC7043), ref: 02AC6F4E
Part of subcall function 02AC6F30: GetProcAddress.KERNEL32(00000000), ref: 02AC6F55
Part of subcall function 02AC6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02AC6F7B
Part of subcall function 02AC6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02AC6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 02ACA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 02ACA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 02ACA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 02ACA21B
GetDriveTypeA.KERNEL32(?), ref: 02ACA265
lstrcat.KERNEL32(?,00000000), ref: 02ACA29F
lstrcat.KERNEL32(?,00410A34), ref: 02ACA2C5
lstrcat.KERNEL32(?,00000022), ref: 02ACA2D9
lstrcat.KERNEL32(?,00410A34), ref: 02ACA2F4
wsprintfA.USER32 ref: 02ACA31D
lstrcat.KERNEL32(?,00000000), ref: 02ACA345
lstrcat.KERNEL32(?,?), ref: 02ACA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 02ACA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 02ACA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 02ACA1D1

Part of subcall function 02AC9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 02AC999D
Part of subcall function 02AC9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 02AC99BD
Part of subcall function 02AC9966: RegCloseKey.ADVAPI32(?), ref: 02AC99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 02ACA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 02ACA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 02ACA41D

Strings

P, xrefs: 02ACA011
", xrefs: 02ACA142
", xrefs: 02ACA2DF
", xrefs: 02ACA3F0
D, xrefs: 02ACA1F5
\, xrefs: 02AC9F73

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: ed1f7ba47c0d5a0ef80aec24ffe353f9ee8b40c07c08008a70f91cdd74c55c8f
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: ABF133B1D4025DAFDF11DFA09D88FEF77BDAB08304F2444AAE605E2141EB758A848F65

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 02AC7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 02AC7D21
GetUserNameA.ADVAPI32(?,?), ref: 02AC7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02AC7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 02AC7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02AC7DC0
EqualSid.ADVAPI32(?,?), ref: 02AC7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 02AC7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02AC7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02AC7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 02AC7E12
LocalFree.KERNEL32(00000000), ref: 02AC7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02AC7E35

Strings

PromptOnSecureDesktop, xrefs: 02AC7FA0
D, xrefs: 02AC7D73

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 7b9132e8dd3ef194ab6c32d4a4f1cd073d822ac36a3db40e3c4831cb9803f7a2
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 4FA15FB2900219AFDF118FA1DD88FEEBBBDFB08344F14816AE505E6150DB758A85CF64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

va=%08X%08X uef=%p, xrefs: 00406595
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
Jan 13 2018, xrefs: 0040653A
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
%d=%p, xrefs: 004066F9
localcfg, xrefs: 0040672D
except_info, xrefs: 00406728
plgs:, xrefs: 004066AA

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

quit, xrefs: 0040A86C
data, xrefs: 0040A85E
Too small respons, xrefs: 0040A9C9
rcpt to:<%s>, xrefs: 0040A855
Incorrect respons, xrefs: 0040AB39
mail from:<%s>, xrefs: 0040A848
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ESMTP, xrefs: 0040AA38
., xrefs: 0040A8CA
AUTH LOGIN, xrefs: 0040A80C
localcfg, xrefs: 0040AB0B
ehlo %s, xrefs: 0040A7F5
helo %s, xrefs: 0040A803
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 02AC7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02AC7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02AC7ACD
GetLengthSid.ADVAPI32(?), ref: 02AC7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02AC7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02AC7B1F
EqualSid.ADVAPI32(?,?), ref: 02AC7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 02AC7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02AC7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02AC7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02AC7B77
LocalFree.KERNEL32(00000000), ref: 02AC7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02AC7B9A
GetAce.ADVAPI32(?,?,?), ref: 02AC7BCA
EqualSid.ADVAPI32(?,?), ref: 02AC7BF1
DeleteAce.ADVAPI32(?,?), ref: 02AC7C0A
EqualSid.ADVAPI32(?,?), ref: 02AC7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 02AC7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02AC7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02AC7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02AC7CE0
LocalFree.KERNEL32(00000000), ref: 02AC7CEE

Strings

D, xrefs: 02AC7AC3

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 08ef20cf7bd75856e68c4ab0dc8446901c2bd13524ee34c23a94f92ddd938223
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 87814D7190021AAFDB11CFA5DD84FEEBBBCBF08344F14806AE615E6150DB759A41CF64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetAdaptersInfo, xrefs: 004019DC
123.45.67.89, xrefs: 004019A6
GetIfEntry, xrefs: 004019E4
Iphlpapi.dll, xrefs: 004019B7
GetBestInterface, xrefs: 004019EF
localcfg, xrefs: 004019A3

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 02AC858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 02AC865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 02AC867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 02AC86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02AC86B1

Strings

PromptOnSecureDesktop, xrefs: 02AC85B6, 02AC8645, 02AC86BD, 02AC8708, 02AC87C5, 02AC8812, 02AC88E9, 02AC8905
", xrefs: 02AC896C

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 3d119fd11d88b874ca8b2db30236301af6dd5081689a2881516e3675571b076a
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 5CC18FB1940249FEEB12ABA4DD84EEF7BBDFB04344F24407AF605E6050EF744A948B65

Function 02AC14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02AC1601
lstrlenW.KERNEL32(-00000003), ref: 02AC17D8

Strings

<, xrefs: 02AC15DF
, xrefs: 02AC16C9
D, xrefs: 02AC182D
@, xrefs: 02AC15E7

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: d216e11b4876b2a64f2001163a468d4826bc29e9e086f8513d149408158f4d03
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 5CF18CB1608341DFD720DF64C888BABB7E5FB88304F10892DF59A97291DBB4D944CB56

Function 02AC7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 02AC76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 02AC7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 02AC778F
___ascii_stricmp.LIBCMT ref: 02AC78B4
RegCloseKey.ADVAPI32(?), ref: 02AC794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 02AC796D
RegCloseKey.ADVAPI32(?), ref: 02AC797E
RegCloseKey.ADVAPI32(?), ref: 02AC79AC
RegCloseKey.ADVAPI32(?), ref: 02AC7A56

Part of subcall function 02ACF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,02AC772A,?), ref: 02ACF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02AC79F6
RegCloseKey.ADVAPI32(?), ref: 02AC7A4D

Strings

PromptOnSecureDesktop, xrefs: 02AC76C5, 02AC76CA, 02AC76E5, 02AC7782, 02AC77E6, 02AC7862, 02AC787B, 02AC79C2
", xrefs: 02AC7800

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 727942a69f7db99c59d688b056cb50b7099a22548feaa494b678926d839a12e1
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 6BC16371940119AFDB21DBA4DD84FEEBBBEEF49710F2440AAE504E6150EF719A84CF60

Function 02AC2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02AC2CED
socket.WS2_32(00000002,00000002,00000011), ref: 02AC2D07
htons.WS2_32(00000000), ref: 02AC2D42
select.WS2_32 ref: 02AC2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 02AC2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02AC2E62

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: b28830a6ef8e3fe72e65a9b0dd77033c3f3fa8ffba24216fb6cb439a316af100
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: D861C1B1504309ABC3209F64DC48B6BBBF8EB48755F25481EFD84A7150DFB5D880CBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
127.0.0.1, xrefs: 0040ADEB
%s%d, xrefs: 0040AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 02AC958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 02AC95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 02AC95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 02AC95DC
wsprintfA.USER32 ref: 02AC9635
wsprintfA.USER32 ref: 02AC9673
wsprintfA.USER32 ref: 02AC96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02AC9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02AC978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02AC97D8

Strings

PromptOnSecureDesktop, xrefs: 02AC9604, 02AC9624, 02AC9662, 02AC9683, 02AC96B6, 02AC96DF, 02AC9701, 02AC9734, 02AC9780, 02AC97B7

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: e4370cc1394cf319aa8362f03900030c1e7bfa1e732adcc23aadf851994bc924
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: ADA16DB1940249EFEB21DFA0CD85FEB3BADEB04740F20402AFA15A6151EB75D584CFA5

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
86A, xrefs: 0040BF98
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62
06A, xrefs: 0040BF70

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_USER, xrefs: 0040B431
%TO_EMAIL, xrefs: 0040B473
%TO_HASH, xrefs: 0040B4B0
%FROM_DOMAIN, xrefs: 0040B41E
%s@%s, xrefs: 0040B461
%TO_USER, xrefs: 0040B488
%M5DATE, xrefs: 0040B50F
%P5DATE, xrefs: 0040B4F2
%TO_DOMAIN, xrefs: 0040B44B
%DATE, xrefs: 0040B4D2
%FROM_EMAIL, xrefs: 0040B3E9

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 02AC1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 02AC202D
GetSystemInfo.KERNEL32(?), ref: 02AC204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 02AC206A
GetProcAddress.KERNEL32(00000000), ref: 02AC2071
GetCurrentProcess.KERNEL32(?), ref: 02AC2082
GetTickCount.KERNEL32 ref: 02AC2230

Part of subcall function 02AC1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 02AC1E7C

Strings

localcfg, xrefs: 02AC2091, 02AC2098, 02AC20AB, 02AC20E4, 02AC20F3, 02AC2119, 02AC2138, 02AC214E, 02AC2166, 02AC2183, 02AC219B, 02AC21B7, 02AC21D7
work_srv, xrefs: 02AC20C5
flags_upd, xrefs: 02AC20A5, 02AC20AA, 02AC20E3
hi_id, xrefs: 02AC217D, 02AC2182, 02AC219A

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: f6e1698765e608a7c3a760930c628acc493b8fb17089450fe1627d6bb9668570
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 055127B0540344AFE330AF758D85F67BAECEF54704F10492DF99682242DFB9A984CB65

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 02AC3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 02AC3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02AC3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 02AC3095
RtlAllocateHeap.NTDLL(00000000), ref: 02AC30B6
htons.WS2_32(00000035), ref: 02AC30EF
inet_addr.WS2_32(?), ref: 02AC30FA
gethostbyname.WS2_32(?), ref: 02AC310D
HeapFree.KERNEL32(00000000), ref: 02AC314D

Strings

iphlpapi.dll, xrefs: 02AC3062, 02AC3067, 02AC3077

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 16423502c049615f6fb6d030cb6b7895d07d83caa4a2ff19655e3159af04388b
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 8C31C431A00206AFDF119BB89C88BAE77B8AF04365F24C1A9E518E7390DF74D5458B58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 02AC6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 02AC67C3
htonl.WS2_32(?), ref: 02AC67DF
htonl.WS2_32(?), ref: 02AC67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02AC68F1
ExitProcess.KERNEL32 ref: 02AC69BC

Strings

localcfg, xrefs: 02AC6994
except_info, xrefs: 02AC698F

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 04550adf098530d40fed65c308dee7961e3e12d5d9b7aeecc896688484e69a8a
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 50616D71A40208AFDB609FA4DC45FEA77E9FB48300F24806AFA69D2161EB759990CF14

Function 02ACF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(02ACCC84), ref: 02ACF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 02ACF5CE
closesocket.WS2_32(00000000), ref: 02ACF5DC

Strings

time_cfg, xrefs: 02ACF58A

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 309914816024b2567b4f09765c3f0bacb3b238766b470c942b8cdffe1ce700ff
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 99315C72900118AFDB10DFA5DC88DEE7BBDEF88310F20456AF915E3150EB709A818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 02AC2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02AC2FA1
LoadLibraryA.KERNEL32(?), ref: 02AC2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 02AC2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02AC3000
RtlAllocateHeap.NTDLL(00000000), ref: 02AC3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 02AC3032

Strings

dnsapi.dll, xrefs: 02AC2F90

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 4e6efcb91ab85b917452a5849e724d90ab1d0460484936e1d10068ceed40bc88
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: F2217771D41619BBCF219B55DC84AEEBBBCEF08B50F108465F905E7140DB749A8187D4

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 02AC6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\jfniizgw,02AC7043), ref: 02AC6F4E
GetProcAddress.KERNEL32(00000000), ref: 02AC6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02AC6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02AC6F92

Strings

PromptOnSecureDesktop, xrefs: 02AC6F9D, 02AC6FBF, 02AC6FCF, 02AC6FE5, 02AC6FF5
\\.\pipe\jfniizgw, xrefs: 02AC6F37
C:\Windows\SysWOW64\, xrefs: 02AC6F30, 02AC6F38, 02AC6F65, 02AC6F6C, 02AC6F7A, 02AC6F85, 02AC6F91, 02AC6FA9, 02AC6FC6, 02AC6FEC

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\jfniizgw
API String ID: 1082366364-1680333594
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: d2f1d04c8e8d16af2e0a5b2c95acb452fdb97a6b85f6f66ab0db2f25f9775864
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: EA2104217803407DF72297319DC8FFB2E4D8B52B24F2840AEF904E5580DFD984D686AD

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 02AC92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 02AC92E2
wsprintfA.USER32 ref: 02AC9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02AC9375
lstrlen.KERNEL32(?,?,00000000), ref: 02AC9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 02AC9394
CloseHandle.KERNEL32(00000000), ref: 02AC939B

Strings

PromptOnSecureDesktop, xrefs: 02AC932B, 02AC9343, 02AC935E

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: b28c4fb3f9d159dee6801d0f081fcbdbbeb43c34b9ffa7ecd44c3ddecf5963c9
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 4A1172B17401147BE7206771EE0DFEF3A6EDBC8B10F10806ABB09E5090EEB44E418BA4

Function 02AC99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02AC9A18
GetThreadContext.KERNEL32(?,?), ref: 02AC9A52
TerminateProcess.KERNEL32(?,00000000), ref: 02AC9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02AC9A98
SetThreadContext.KERNEL32(?,00010002), ref: 02AC9AB5
ResumeThread.KERNEL32(?), ref: 02AC9AC2

Strings

D, xrefs: 02AC9A10

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 9b27f4a86a7b25cd76c4974f216773a6d9ca5eca07098c62b693717ca06618c3
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 4C213BB1A01219BBDF11DBA1DC49EEF7BBCEF04750F504065FA19E1050EB758A45CBA4

Function 02AC1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 02AC1C18
LoadLibraryA.KERNEL32(004102C8), ref: 02AC1C26
GetProcessHeap.KERNEL32 ref: 02AC1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 02AC1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 02AC1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 02AC1D02
FreeLibrary.KERNEL32(?), ref: 02AC1D0B

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 2d10a2138d5e6b5d20c265097ce25f53e3946cd46885f9c4e73107c9bc14126c
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: ED313A32E00219BFCB129FA4DCC89EEBAB9EB45715B34447EF509A2111DBB54E80DB94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 02AC6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02AC6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02AC6D22
GetLastError.KERNEL32 ref: 02AC6DA7
CloseHandle.KERNEL32(?), ref: 02AC6DB5
GetLastError.KERNEL32 ref: 02AC6DD6
DeleteFileA.KERNEL32(?), ref: 02AC6DE7
GetLastError.KERNEL32 ref: 02AC6DFD

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: e0471e81f520155d52cba6de4406870ecd24b084fd56967af34d513f5f5f154d
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 8531E776900649BFCB02DFA4DD84ADE7FBDEF88710F24806AE251E3250DB7089558BA1

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 02AC93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 02AC93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 02AC93CD
CharToOemA.USER32(?,?), ref: 02AC93DB
wsprintfA.USER32 ref: 02AC9410

Part of subcall function 02AC92CB: GetTempPathA.KERNEL32(00000400,?), ref: 02AC92E2
Part of subcall function 02AC92CB: wsprintfA.USER32 ref: 02AC9350
Part of subcall function 02AC92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02AC9375
Part of subcall function 02AC92CB: lstrlen.KERNEL32(?,?,00000000), ref: 02AC9389
Part of subcall function 02AC92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 02AC9394
Part of subcall function 02AC92CB: CloseHandle.KERNEL32(00000000), ref: 02AC939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02AC9448

Strings

PromptOnSecureDesktop, xrefs: 02AC93FA, 02AC93FF, 02AC941C

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 744e0ff1de9ba136298fa5037b4b68fede678e1b044087abdb577f778d2b4452
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: E40192F6940118BBD720A7619D89EDF377CDB95701F0040A6BB49E2080EAB497C48F75

Function 02ACAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 02ACAAE5

Strings

, xrefs: 02ACABB3
localcfg, xrefs: 02ACAD72

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: c3c1a404d2b7124a8a19904e562d77d770eb000c1d04f97c8f1e7e34faa141b8
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 33713D72A4430CAADF228F94EDC5FFE376A9B00719F34402FFA05A6092DF6199848B55

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 02ACE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02ACDF6C: GetCurrentThreadId.KERNEL32 ref: 02ACDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 02ACE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,02AC6128), ref: 02ACE950
lstrcmp.KERNEL32(?,00000008), ref: 02ACE989

Strings

A, xrefs: 02ACE8C6, 02ACE8CD, 02ACE936, 02ACE998
A, xrefs: 02ACE9A0
A, xrefs: 02ACE960, 02ACE965

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 69ee697530233958e8ea703659a630662db4f57e88b0a6e5b5491f73afe4729d
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: B6319E31A04705DBDF79CF24CAC4BA6BBE8FB09724F20892EE55587550DB74E880CB81

Function 02AC6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02AC6E19

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 125b20d4faadb30380566825b29f456e05411e2b071f47034fcb44822e95e48a
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: DA211FB6104119BFDB109B61ED88EDF7FADDB89AA5B20842AF502D5090EF70DA409A74

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 02ACC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02ACC6B4
InterlockedIncrement.KERNEL32(02ACC74B), ref: 02ACC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,02ACC747), ref: 02ACC728
CloseHandle.KERNEL32(00000000,?,02ACC747,00413588,02AC8A77), ref: 02ACC733

Strings

localcfg, xrefs: 02ACC544

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 4d704acc50a453173ca13e31d6654ea096de445e1b2a96ffc76c062872ac3895
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: D0514FB1A41B458FD7249F29C6D4626BBFAFB48314B60693FE18BC7A90DB74E440CB10

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 02ACE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02ACE50A,00000000,00000000,00000000,00020106,00000000,02ACE50A,00000000,000000E4), ref: 02ACE319
RegSetValueExA.ADVAPI32(02ACE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 02ACE38E
RegDeleteValueA.ADVAPI32(02ACE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 02ACE3BF
RegCloseKey.ADVAPI32(02ACE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,02ACE50A), ref: 02ACE3C8

Strings

PromptOnSecureDesktop, xrefs: 02ACE33A

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: b0669220aeb55db5b73809aac0990e0e46dfc548a0a26ed72c6c8569f99f50ad
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 69215C71A0021DBBDF209FA4ED89EEE7F79EF08760F108065F904E6150EB719A54DBA0

Function 02AC71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02AC71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02AC7228
LocalFree.KERNEL32(?,?,?), ref: 02AC7286
wsprintfA.USER32 ref: 02AC729D

Strings

|, xrefs: 02AC721A

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 917c653a46b49a89ddaf180f090a6c634719acf44abeb6038e8c15a3551d30dd
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 12310976900208BFDB01DFA8DD45ADABBADEF04314F24806AF959DB204EB75D6488F94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 02ACB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02ACB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 02ACB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 02ACB548
GetTimeZoneInformation.KERNEL32(?), ref: 02ACB590
wsprintfA.USER32 ref: 02ACB61E

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: bd9f97d5e8833d09c4ff0723640ff2566b35352b1b9421e470671f5f6c4cbe7d
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: F25131B1D0021CAACF14CFD5D9895EEBBB9BF48304F10852AF501B6150E7B94AC9CFA8

Function 02AC62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 02AC6303
LoadLibraryA.KERNEL32(?), ref: 02AC632A
GetProcAddress.KERNEL32(00000000,?), ref: 02AC63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 02AC6405

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 175403e817e80d58ab4e718d8d67e06ecb80a565259c9bb3788ae781d2721c37
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 86414D71A00205EFDB14CF58C984BA9B7B8FF84B58F2481ADE865D7390DB71E941CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 02ACE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02ACDF6C: GetCurrentThreadId.KERNEL32 ref: 02ACDFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,02ACA6AC), ref: 02ACE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,02ACA6AC), ref: 02ACE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,02ACA6AC), ref: 02ACE819

Strings

PromptOnSecureDesktop, xrefs: 02ACE840, 02ACE845, 02ACE87C, 02ACE89B

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 1c8ec6f4395eb9a164b7e0fef479ca2bdcb9efb5d2dbb0422024163efdcda56e
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 4D21E7B1A84300BAE22077259E45FEB3E1DDB65B60F30003DBA09B51D3FE5595508AF5

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 02AC7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 02AC76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 02AC796D
RegCloseKey.ADVAPI32(?), ref: 02AC797E

Strings

PromptOnSecureDesktop, xrefs: 02AC76C5, 02AC76CA, 02AC76E5

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 930d92dffb251d09a30cfbfbe020b9c4be990b6e0c218fe632fe0785898cf75c
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 1B11AC70A00109AFDB119FA9EC85FAFFFBDEB85714F240169F515E6290EBB189408F60

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 02AC9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 02AC999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 02AC99BD
RegCloseKey.ADVAPI32(?), ref: 02AC99C6

Strings

PromptOnSecureDesktop, xrefs: 02AC9989, 02AC998E, 02AC99B0, 02AC99D3

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: c667b6bcb756c47e6dc42a7b0ac14c8f75289c09d3728ff5ae07dfe800c153e4
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 84F0C2B2680208BBF7106B54AC46FDB3A2DDB94B10F200075FA05B5091FAE59A9086B9

Function 02AC28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 02AC28FA
gethostbyname.WS2_32(u6A), ref: 02AC2906

Strings

u6A, xrefs: 02AC28EC, 02AC28F9, 02AC2905
time_cfg, xrefs: 02AC28EB

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: fc940d6db3f8865873b444b18475fd8487fc08b013401a3278df82c76b0f718e
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: FEE0EC306085119FDB509B28F888BD577A5AF4A230F158599F854D71A0CB749C819754

Function 02AC69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 02AC69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 02AC6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 02AC6A3A
CloseHandle.KERNEL32(000000FF), ref: 02AC6BD8

Part of subcall function 02ACEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02AC1DCF,?), ref: 02ACEEA8
Part of subcall function 02ACEE95: HeapFree.KERNEL32(00000000), ref: 02ACEEAF

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: a53cb5e8d0551f370d509d6b6666ee314cd599ce16186cf1378b0ee7af712a44
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 8C712871D4021DEFDF10DFA4CD80AEEBBB9FB44754F20456AE615AA190DB309E92CB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 02AC41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02AC421F
GetLastError.KERNEL32 ref: 02AC4229
WaitForSingleObject.KERNEL32(?,?), ref: 02AC423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02AC424D

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: ccdcf10e0e17fa98cec21f594df4a37cff1104417d5215e87fc2a0f0bcfd2bb8
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: B601C872911109AFEF01DF90ED85BEF7BBCEB18255F108465F901E2050DB70DA548BBA

Function 02AC417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02AC41AB
GetLastError.KERNEL32 ref: 02AC41B5
WaitForSingleObject.KERNEL32(?,?), ref: 02AC41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02AC41D9

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: bf662b964e6785078f72ec58be96c56285f85e45da905fa5176ff34f70ff408a
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 35010C7651110AAFDF01DF90ED88BEF7B7CEB18255F104065F911E2150DB70DA548BB9

Function 02ACE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 02ACE066

Strings

A, xrefs: 02ACE07F
A, xrefs: 02ACE037, 02ACE03C
A, xrefs: 02ACE036

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: cf2fc0cc859874869dc9716b581c4accb815336ed634d15429722b7c3bbeb30c
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 06F06231200702DBCB30CF25D9C4A82B7E9FB05335B64862EE554D3460D774A498CB95

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 02ACE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,02AC44E2,00000000,00000000,00000000), ref: 02ACE470
CloseHandle.KERNEL32(00000001,00000003), ref: 02ACE484

Part of subcall function 02ACE2FC: RegCreateKeyExA.ADVAPI32(80000001,02ACE50A,00000000,00000000,00000000,00020106,00000000,02ACE50A,00000000,000000E4), ref: 02ACE319
Part of subcall function 02ACE2FC: RegSetValueExA.ADVAPI32(02ACE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 02ACE38E
Part of subcall function 02ACE2FC: RegDeleteValueA.ADVAPI32(02ACE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 02ACE3BF
Part of subcall function 02ACE2FC: RegCloseKey.ADVAPI32(02ACE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,02ACE50A), ref: 02ACE3C8

Strings

PromptOnSecureDesktop, xrefs: 02ACE4F1, 02ACE4F6, 02ACE537, 02ACE561

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 0f7ad4295864a2272ba0b591c528ca987b65679a70409ce0407415267f5396ad
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 0B41DAB2940218FAEB206F518F85FDB3B6DDB04764F24807DFD19A4091EBB58650DAB4

Function 02AC8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 02AC83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 02AC8477

Part of subcall function 02AC69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 02AC69E5
Part of subcall function 02AC69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 02AC6A26
Part of subcall function 02AC69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 02AC6A3A

Part of subcall function 02ACEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02AC1DCF,?), ref: 02ACEEA8
Part of subcall function 02ACEE95: HeapFree.KERNEL32(00000000), ref: 02ACEEAF

Strings

PromptOnSecureDesktop, xrefs: 02AC83B2, 02AC83B7, 02AC8483

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 4282a061979dc35fc7d8828ce36ef45ac4cbfe1d879d7f8473dc072bfff03407
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 8B414DB2940109BEEB11EBA49FC0EEF77ADEB04344F2444AEE504E6110EFB45A948B64

Function 02ACE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,02ACE859,00000000,00020119,02ACE859,PromptOnSecureDesktop), ref: 02ACE64D
RegCloseKey.ADVAPI32(02ACE859,?,?,?,?,000000C8,000000E4), ref: 02ACE787

Strings

PromptOnSecureDesktop, xrefs: 02ACE637

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 54435f3736a583d3131e05fe655c9f6f6e784fdb5249656ada256d5abd6e22c1
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 354108B2D0015DFFDF11AF94DD81EEEBBBAFB04304F24446AEA00B6150EB719A559B60

Function 02ACAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02ACAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 02ACB00D

Part of subcall function 02ACAF6F: gethostname.WS2_32(?,00000080), ref: 02ACAF83
Part of subcall function 02ACAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 02ACAFE6

Part of subcall function 02AC331C: gethostname.WS2_32(?,00000080), ref: 02AC333F
Part of subcall function 02AC331C: gethostbyname.WS2_32(?), ref: 02AC3349

Part of subcall function 02ACAA0A: inet_ntoa.WS2_32(00000000), ref: 02ACAA10

Strings

%OUTLOOK_BND_, xrefs: 02ACB076, 02ACB07B, 02ACB0BE, 02ACB0DD

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 29b721a7f76f8c10a39cbd27b655d6f180755b8ddc50ea093c9b04267bab47e0
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 94416D7294024CAFDF21EFA0DC45EEE3BADFB08314F24442BBA24D2151EA75DA448F64

Function 02AC9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 02AC9536
Sleep.KERNEL32(000001F4), ref: 02AC955D

Strings

, xrefs: 02AC94D9

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 64c767c656caeed4e6ee4ef8255aeb48008844d54d5731fdd625d6a488da2fef
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 464107B180438E6EFB368B64D9CC7F77BA49B02314F3441ADD48297192DF744989C711

Function 02ACBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02ACB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 02ACBA3A
InterlockedIncrement.KERNEL32(?), ref: 02ACBA94
GetTickCount.KERNEL32 ref: 02ACBB79
GetTickCount.KERNEL32 ref: 02ACBB99
InterlockedIncrement.KERNEL32(?), ref: 02ACBE15
closesocket.WS2_32(00000000), ref: 02ACBEB4

Strings

%FROM_EMAIL, xrefs: 02ACBC7D

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 528c5cef9480262db2f85edd8b69987a959d45f554e493a5a7af0e2300923a59
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: C6319E71400248DFDF25DFA4DC85BEAB7B9EB44704F20485AFA2492150DF32D685CF20

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 02AC709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 02AC70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 02AC70F4

Strings

|, xrefs: 02AC70E6

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 3980371b492c3f18a40fb398acb36021cf6b4d87a6820964b15a19a01f07af94
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: BE11FA72900118EBDB11CFD5DC84ADEB7BDAB04715F2481AAE501E62A4DB709B88CFA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.2135476167.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2135476167.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 02AC3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02AC2F88: GetModuleHandleA.KERNEL32(?), ref: 02AC2FA1
Part of subcall function 02AC2F88: LoadLibraryA.KERNEL32(?), ref: 02AC2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02AC31DA
HeapFree.KERNEL32(00000000), ref: 02AC31E1

Memory Dump Source

Source File: 00000000.00000002.2136828797.0000000002AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ac0000_fdnoqmpv.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 31266dd7b80b2644cacb4aff5643f61d331849f243e937acaea8edbc7f681ee9
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: D3516C7590024AAFCF019F64DC88AFAB775FF15305B2485A9EC96C7210EB329A19CB90

Analysis Process: fzzrueiu.exePID: 2640, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	30.5%
Signature Coverage:	0%
Total number of Nodes:	1576
Total number of Limit Nodes:	14

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\fdnoqmpv.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

C:\Users\user\Desktop\fdnoqmpv.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
miqllcjz, xrefs: 0040A389, 0040A397
", xrefs: 0040A189
D, xrefs: 00409F8E
", xrefs: 0040A078
P, xrefs: 00409DAA
\, xrefs: 00409D0C
%X%08X, xrefs: 0040A0B0
C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 0040A1D9
", xrefs: 00409EDB

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\fdnoqmpv.exe$C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe$D$P$\$miqllcjz
API String ID: 2089075347-2324929444
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 02B5003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02B5024D

Strings

kernel32.dll, xrefs: 02B5008F, 02B50095
cess, xrefs: 02B5018D

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 821bedec49acb24693a21ae71ce52af293cbcb3bb01fe2280baf47763d91b231
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: DA526974A01229DFDB64DF68C985BACBBB1BF09304F1484D9E94DAB351DB30AA85CF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 02B87238 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02B87260
Module32First.KERNEL32(00000000,00000224), ref: 02B87280

Memory Dump Source

Source File: 0000000C.00000002.2152720884.0000000002B82000.00000040.00000020.00020000.00000000.sdmp, Offset: 02B82000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b82000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 37599476e560b213b5a220a023bbeaf248ae0724eb41f3cd67018803c7ae6370
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A0F0C8355007146BD7203EB8AC8CB6AB6E8EF46228F2002A8F68A910C0DF70E8458A52

Function 02B50E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02B50223,?,?), ref: 02B50E19
SetErrorMode.KERNELBASE(00000000,?,?,02B50223,?,?), ref: 02B50E1E

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: fe2ffd228ee814aa6645193ff169a6dcf1091009a50bf38f89cc0308feb338e2
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 2CD01232645228B7DB003A94DC09BCEBB1CDF09BA6F108461FB0DED080CBB09A4046EA

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 02B86EF7 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02B86F48

Memory Dump Source

Source File: 0000000C.00000002.2152720884.0000000002B82000.00000040.00000020.00020000.00000000.sdmp, Offset: 02B82000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b82000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ff1951bd5dedbea3e2382f734877af4e58c85e2b14af5a34e4d8e698ecca3842
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 66110B79A00208EFDB01DF98C985E99BBF5AF08751F1580A4F9489B361D771EA50EF90

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 02B565E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 02B565F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02B56610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02B56631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02B56652

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 0dc5d20dfd5f064561891013f6c62445108f2822086109a5fd1c3521e95f8f84
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 1D1151B1600228BFDB219F65EC45F9B3FACEB057A5F104064FE08AB251D7B1DD008AA4

Function 02B59EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02B59E6D
lstrcpy.KERNEL32(?,00000000), ref: 02B59FE1
lstrcat.KERNEL32(?,?), ref: 02B59FF2
lstrcat.KERNEL32(?,0041070C), ref: 02B5A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 02B5A054
DeleteFileA.KERNEL32(?), ref: 02B5A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02B5A0D6
lstrcpy.KERNEL32 ref: 02B5A12F
lstrlen.KERNEL32(00000022), ref: 02B5A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 02B59F13

Part of subcall function 02B57029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 02B57081

Part of subcall function 02B56F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\jfniizgw,02B57043), ref: 02B56F4E
Part of subcall function 02B56F30: GetProcAddress.KERNEL32(00000000), ref: 02B56F55
Part of subcall function 02B56F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02B56F7B
Part of subcall function 02B56F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02B56F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 02B5A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 02B5A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 02B5A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 02B5A21B
GetDriveTypeA.KERNEL32(?), ref: 02B5A265
lstrcat.KERNEL32(?,00000000), ref: 02B5A29F
lstrcat.KERNEL32(?,00410A34), ref: 02B5A2C5
lstrcat.KERNEL32(?,00000022), ref: 02B5A2D9
lstrcat.KERNEL32(?,00410A34), ref: 02B5A2F4
wsprintfA.USER32 ref: 02B5A31D
lstrcat.KERNEL32(?,00000000), ref: 02B5A345
lstrcat.KERNEL32(?,?), ref: 02B5A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 02B5A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 02B5A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 02B5A1D1

Part of subcall function 02B59966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 02B5999D
Part of subcall function 02B59966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 02B599BD
Part of subcall function 02B59966: RegCloseKey.ADVAPI32(?), ref: 02B599C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 02B5A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 02B5A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 02B5A41D

Strings

P, xrefs: 02B5A011
", xrefs: 02B5A2DF
D, xrefs: 02B5A1F5
\, xrefs: 02B59F73
", xrefs: 02B5A3F0
", xrefs: 02B5A142

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: fd34ba5254221ef080569d3e927840871edd356429d9718add349f7e2ceb979a
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 2AF14FB1C40269EFDB11DBA0DD48FEE7BBCEB08304F0481E5EA05EA141E7759A858F64

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlLengthSid, xrefs: 00401246
RtlInitUnicodeString, xrefs: 00401135
ntdll.dll, xrefs: 0040100D
NtSetInformationThread, xrefs: 00401155
RtlSetLastWin32Error, xrefs: 004010D6
NtDuplicateToken, xrefs: 004011F3
NtQueryInformationToken, xrefs: 00401262
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtOpenProcessToken, xrefs: 004011D4
NtTerminateProcess, xrefs: 004010F6
NtClose, xrefs: 004011B4
NtFilterToken, xrefs: 0040122B
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlNtStatusToDosError, xrefs: 00401194
RtlFreeSid, xrefs: 00401116
NtSetInformationToken, xrefs: 00401175

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Oct, xrefs: 0040B295
May, xrefs: 0040B272
Feb, xrefs: 0040B25D
Mon, xrefs: 0040B22C
Apr, xrefs: 0040B26B
Wed, xrefs: 0040B23A
Aug, xrefs: 0040B287
Thu, xrefs: 0040B241
Jul, xrefs: 0040B280
Mar, xrefs: 0040B264
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Fri, xrefs: 0040B248
Nov, xrefs: 0040B29C
Jan, xrefs: 0040B256
Sun, xrefs: 0040B225
Tue, xrefs: 0040B233
Sat, xrefs: 0040B24F
Dec, xrefs: 0040B2A3
Sep, xrefs: 0040B28E
Jun, xrefs: 0040B279

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe$D
API String ID: 2976863881-2072606513
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 02B57CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 02B57D21
GetUserNameA.ADVAPI32(?,?), ref: 02B57D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02B57D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 02B57DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02B57DC0
EqualSid.ADVAPI32(?,?), ref: 02B57DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B57DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B57DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02B57E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 02B57E12
LocalFree.KERNEL32(00000000), ref: 02B57E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02B57E35

Strings

C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 02B57F49, 02B57F76, 02B57F8A, 02B57F8B
D, xrefs: 02B57D73

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe$D
API String ID: 2976863881-2072606513
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: b7c22a944bbe053845dd5c98c7285dc016d8e92032fcd45a982b34d71defaaa6
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: EEA14071A00229AFDB11DFA1DD48FEEBB7DFF08304F0481A9E905EA150DB758A85DB64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
localcfg, xrefs: 0040672D
%d=%p, xrefs: 004066F9
plgs:, xrefs: 004066AA
va=%08X%08X uef=%p, xrefs: 00406595
Jan 13 2018, xrefs: 0040653A
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728
12:08:32, xrefs: 00406535
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

ESMTP, xrefs: 0040AA38
quit, xrefs: 0040A86C
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ehlo %s, xrefs: 0040A7F5
., xrefs: 0040A8CA
Incorrect respons, xrefs: 0040AB39
data, xrefs: 0040A85E
localcfg, xrefs: 0040AB0B
helo %s, xrefs: 0040A803
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
rcpt to:<%s>, xrefs: 0040A855
Too small respons, xrefs: 0040A9C9
mail from:<%s>, xrefs: 0040A848
AUTH LOGIN, xrefs: 0040A80C

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 02B57A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02B57A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02B57ACD
GetLengthSid.ADVAPI32(?), ref: 02B57ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02B57B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02B57B1F
EqualSid.ADVAPI32(?,?), ref: 02B57B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B57B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B57B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02B57B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02B57B77
LocalFree.KERNEL32(00000000), ref: 02B57B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02B57B9A
GetAce.ADVAPI32(?,?,?), ref: 02B57BCA
EqualSid.ADVAPI32(?,?), ref: 02B57BF1
DeleteAce.ADVAPI32(?,?), ref: 02B57C0A
EqualSid.ADVAPI32(?,?), ref: 02B57C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B57CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B57CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02B57CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02B57CE0
LocalFree.KERNEL32(00000000), ref: 02B57CEE

Strings

D, xrefs: 02B57AC3

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 700303cf616861b6cd6260510b80bdd6a7f5613389b9d74a027fb115292fd36b
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 22814F71A00229AFDB11CFA5DD84FEEBBB8FF08304F0480A9E905EA150DB759641DFA4

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe$localcfg
API String ID: 237177642-601414241
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

uac, xrefs: 00401628
, xrefs: 00401462
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316
wusa.exe, xrefs: 00401388
D, xrefs: 004015C6
useless, xrefs: 0040161E
PDGu, xrefs: 0040139A
<, xrefs: 00401378

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

start_srv, xrefs: 00401E6C
work_srv, xrefs: 00401E5E
IsWow64Process, xrefs: 00401DF2
loader_id, xrefs: 00401F4B, 00401F6B
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
lid_file_upd, xrefs: 00401E25
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
kernel32, xrefs: 00401DF7
born_date, xrefs: 00401EAD, 00401ECC
net_type, xrefs: 00401E87
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetIfEntry, xrefs: 004019E4
Iphlpapi.dll, xrefs: 004019B7
123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3
GetAdaptersInfo, xrefs: 004019DC
GetBestInterface, xrefs: 004019EF

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 02B5858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 02B5865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 02B5867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 02B586A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02B586B1

Strings

C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 02B5882F, 02B5883C, 02B5884C
", xrefs: 02B5896C

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe
API String ID: 237177642-3116881678
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 13012afd7acd722029f2859d73b4264c37c2ea3a751374d1fd93e63bae77a724
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 55C1A371900258BEEB11EBA4DD85FEF7BBDEB08304F1440A5FA05EA050E7718AD48F65

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 02B514E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02B51601
lstrlenW.KERNEL32(-00000003), ref: 02B517D8

Strings

<, xrefs: 02B515DF
, xrefs: 02B516C9
@, xrefs: 02B515E7
D, xrefs: 02B5182D

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: b49837fe2644e33a006852cc3f8fab30073f209ae11c8fefb92968bd63d41a33
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 6EF1B1B15183519FD720DF68C888BABB7E5FB88304F00896DFA999B390D7B4D944CB52

Function 02B57666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 02B576D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 02B57757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 02B5778F
___ascii_stricmp.LIBCMT ref: 02B578B4
RegCloseKey.ADVAPI32(?), ref: 02B5794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 02B5796D
RegCloseKey.ADVAPI32(?), ref: 02B5797E
RegCloseKey.ADVAPI32(?), ref: 02B579AC
RegCloseKey.ADVAPI32(?), ref: 02B57A56

Part of subcall function 02B5F40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,02B5772A,?), ref: 02B5F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02B579F6
RegCloseKey.ADVAPI32(?), ref: 02B57A4D

Strings

", xrefs: 02B57800

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 76c531f3e8bba5e5c349dc75a5fa8aa1c4d513cd5ea5f36440f4a47374786950
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 75C15171A00269AFEB11DFA4DC44FEEBBB9EF49310F1440E5E904AA150EF759A84DB60

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 02B52CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02B52CED
socket.WS2_32(00000002,00000002,00000011), ref: 02B52D07
htons.WS2_32(00000000), ref: 02B52D42
select.WS2_32 ref: 02B52D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 02B52DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02B52E62

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 9edc1aada59a740b4ee84089bb1603b75e09b61f63ddc8b246c7df4c3865c484
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 9861F372505325ABD720AF60DC48B6BBBF8FB48745F044899FD889B190D7B4D880CBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

127.0.0.1, xrefs: 0040ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488
%TO_DOMAIN, xrefs: 0040B44B
%FROM_EMAIL, xrefs: 0040B3E9
%P5DATE, xrefs: 0040B4F2
%s@%s, xrefs: 0040B461
%TO_EMAIL, xrefs: 0040B473
%FROM_USER, xrefs: 0040B431
%FROM_DOMAIN, xrefs: 0040B41E
%TO_HASH, xrefs: 0040B4B0
%M5DATE, xrefs: 0040B50F

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 02B51FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 02B5202D
GetSystemInfo.KERNEL32(?), ref: 02B5204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 02B5206A
GetProcAddress.KERNEL32(00000000), ref: 02B52071
GetCurrentProcess.KERNEL32(?), ref: 02B52082
GetTickCount.KERNEL32 ref: 02B52230

Part of subcall function 02B51E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 02B51E7C

Strings

hi_id, xrefs: 02B5217D, 02B52182, 02B5219A
work_srv, xrefs: 02B520C5
flags_upd, xrefs: 02B520A5, 02B520AA, 02B520E3
localcfg, xrefs: 02B52091, 02B52098, 02B520AB, 02B520E4, 02B520F3, 02B52119, 02B52138, 02B5214E, 02B52166, 02B52183, 02B5219B, 02B521B7, 02B521D7

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 602b300ee3762d138b06bec4619f5d76fb711925caa6e4cfff8a6b392b45b67e
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: AA51F1B0900358AFE320AF758C85F67BAECEF44704F00495DFD968A142D7B9E584CB65

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 02B53059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 02B53068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02B53078
GetProcAddress.KERNEL32(00000000,00410408), ref: 02B53095
RtlAllocateHeap.NTDLL(00000000), ref: 02B530B6
htons.WS2_32(00000035), ref: 02B530EF
inet_addr.WS2_32(?), ref: 02B530FA
gethostbyname.WS2_32(?), ref: 02B5310D
HeapFree.KERNEL32(00000000), ref: 02B5314D

Strings

iphlpapi.dll, xrefs: 02B53062, 02B53067, 02B53077

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: e0bcaff6a1744e085b6e011dd2d219b87b89e493495135a32749880299240cea
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: BA318431A00716ABDB119BB89C48BAE77F8EF047A4F1441E5ED18EB390DB74D5818B68

Function 02B5958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 02B595A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 02B595D5
GetModuleFileNameA.KERNEL32(00000000), ref: 02B595DC
wsprintfA.USER32 ref: 02B59635
wsprintfA.USER32 ref: 02B59673
wsprintfA.USER32 ref: 02B596F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02B59758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02B5978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02B597D8

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 7889003cb5eeeb0a84b0ef9524ca3bc71d4a6e2997717ed34a552c5dd9daf63b
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 6DA17CB1900668EBEB21DFA0DC45FDA3BADEB04740F1040A6FE159A151E7B5D984CFA4

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 02B56778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 02B567C3
htonl.WS2_32(?), ref: 02B567DF
htonl.WS2_32(?), ref: 02B567EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02B568F1
ExitProcess.KERNEL32 ref: 02B569BC

Strings

except_info, xrefs: 02B5698F
localcfg, xrefs: 02B56994

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 88725b4f978a636b92829267ab6f79f3877ebb1355a4350bdd870361328f1dd5
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 2B616F71A40218AFDB609FB4DC45FEA77E9FF08300F148066FA6DD6161DBB5A9908F14

Function 02B5F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(02B5CC84), ref: 02B5F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 02B5F5CE
closesocket.WS2_32(00000000), ref: 02B5F5DC

Strings

time_cfg, xrefs: 02B5F58A

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: fc278130314db384a62ad7f699ef9b241e1c9ed376a81bbccbbd4c1474f4ff30
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: B9317C76900128ABDB11DFA5DC88EEEBBFCEF89310F1045A6F905D7150E7708A81CBA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 02B52F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02B52FA1
LoadLibraryA.KERNEL32(?), ref: 02B52FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 02B52FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02B53000
RtlAllocateHeap.NTDLL(00000000), ref: 02B53007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 02B53032

Strings

dnsapi.dll, xrefs: 02B52F90

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: a6a14b9a932512481559982a348f6d2521eba0965ac7ffd98efaa2d0af0e7619
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 12213071D41729BBCB219B55DC48BAEBBB8EF08B50F1484A1FD05EB240D7B49A8187E4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 02B599E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02B59A18
GetThreadContext.KERNEL32(?,?), ref: 02B59A52
TerminateProcess.KERNEL32(?,00000000), ref: 02B59A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02B59A98
SetThreadContext.KERNEL32(?,00010002), ref: 02B59AB5
ResumeThread.KERNEL32(?), ref: 02B59AC2

Strings

D, xrefs: 02B59A10

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 8fa364e010fac5b3ab620c549bf1fd374af0e2ba6a93712637112b71daf9e9e6
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: AF212AB1A01229BBDF119BA1DC09FEFBBBCEF05750F4040A1FA19E6050E7758A44CEA4

Function 02B51C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 02B51C18
LoadLibraryA.KERNEL32(004102C8), ref: 02B51C26
GetProcessHeap.KERNEL32 ref: 02B51C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 02B51C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 02B51CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 02B51D02
FreeLibrary.KERNEL32(?), ref: 02B51D0B

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 20582bfe35f8f64ab7641b4761912c3f3e2dd91b2ec21c1c352d4aaac43edcc2
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: DC316131D10229BFCB119FE8DC88AFEBBB9EB45305B2444BAE905AA150D7B54E80DB54

Function 02B56CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02B56CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02B56D22
GetLastError.KERNEL32 ref: 02B56DA7
CloseHandle.KERNEL32(?), ref: 02B56DB5
GetLastError.KERNEL32 ref: 02B56DD6
DeleteFileA.KERNEL32(?), ref: 02B56DE7
GetLastError.KERNEL32 ref: 02B56DFD

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ad063546108f3a1de224834b59acdd557179193ea7833a4c46a4680dd2774ebc
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: F2312372800259BFCB01DFA4DD44BEE7FBDEB48300F0485A5EA11EB290D7708A81CB61

Function 02B56F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\jfniizgw,02B57043), ref: 02B56F4E
GetProcAddress.KERNEL32(00000000), ref: 02B56F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02B56F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02B56F92

Strings

\\.\pipe\jfniizgw, xrefs: 02B56F37
C:\Windows\SysWOW64\, xrefs: 02B56F30, 02B56F38, 02B56F65, 02B56F6C, 02B56F7A, 02B56F85, 02B56F91, 02B56FA9, 02B56FC6, 02B56FEC

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\jfniizgw
API String ID: 1082366364-1567519040
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 4f0433668ddace705ef3c98920c4e38797d12b2f33d92b679024b8457e5a16c6
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 7C210E21B413603AF72297319C88FFB6E8DCF52724F1C80E5FC04AA490DBD984D686AD

Function 02B5AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 02B5AAE5

Strings

, xrefs: 02B5ABB3
localcfg, xrefs: 02B5AD72

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 0344700cafbb86559de1f0ebb7434b1a7171f1dbfb4228cd9bc423285571def6
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 35711672A00338ABDF21AA54DC85FEE3769EB01719F2442E6FE04BE0D0DF6295848B55

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 02B5E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02B5DF6C: GetCurrentThreadId.KERNEL32 ref: 02B5DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 02B5E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,02B56128), ref: 02B5E950
lstrcmp.KERNEL32(?,00000008), ref: 02B5E989

Strings

A, xrefs: 02B5E8C6, 02B5E8CD, 02B5E936, 02B5E998
A, xrefs: 02B5E960, 02B5E965
A, xrefs: 02B5E9A0

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: a30b91784907e44d5af3e0bcd287dae9c6b9dc8ca391f793d8fd6f7e7facec5a
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 6131AD31A00725DBDF71CF24C884BA67BE4EF05724F1089AAEA96CF550D374EA81CB91

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 02B56E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02B56E19

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 6a63e0e2e68a3c728d2d39f30bd3993283dbf29d743ed101e7d11cccdeba89cc
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 19216072105125FFDB109BB0FC48FDF3FADDB49265B5084A5F906D9090EB70DA419A74

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 02B592CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 02B592E2
wsprintfA.USER32 ref: 02B59350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02B59375
lstrlen.KERNEL32(?,?,00000000), ref: 02B59389
WriteFile.KERNEL32(00000000,?,00000000), ref: 02B59394
CloseHandle.KERNEL32(00000000), ref: 02B5939B

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: d5da7a6666f93349680d696c02b90b8a4cfbc2573c965a4562f2031f27a755fc
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: D61175B16402247BF7256731DC0DFEF3A6EDBC5B14F00C0A5BF06A9090EEB49A418AA4

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 02B5C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B5C6B4
InterlockedIncrement.KERNEL32(02B5C74B), ref: 02B5C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,02B5C747), ref: 02B5C728
CloseHandle.KERNEL32(00000000,?,02B5C747,00413588,02B58A77), ref: 02B5C733

Strings

localcfg, xrefs: 02B5C544

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: eca346a4cd58943c494ad6a1380dfcb729f8213a4e08028515f35d7479eb32ec
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: C3517FB1A00B518FD7248F69C5C562ABBEAFB48304B50697FE58BCBA90D774F940CB10

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe
API String ID: 124786226-3787335913
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 02B571C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02B571E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02B57228
LocalFree.KERNEL32(?,?,?), ref: 02B57286
wsprintfA.USER32 ref: 02B5729D

Strings

|, xrefs: 02B5721A

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 939af82a8f77603e9ede124d6ee1f6ba281654bbde87c6e73f4aab7e8112d575
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 51311872A00218BBDB11DFA8DC45BDA7BACEF05354F1480A6FD59DB200EB75D6488BA4

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 02B5B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02B5B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 02B5B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 02B5B548
GetTimeZoneInformation.KERNEL32(?), ref: 02B5B590
wsprintfA.USER32 ref: 02B5B61E

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 97087d01b93f24b2c3e71075f1112092963bf46f1569abb28710388fd868a515
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D55102B1D0021DAADF18DFD5D8445EEBBB9FF48304F10816AF505A6150E7B84AC9CF94

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 02B562D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 02B56303
LoadLibraryA.KERNEL32(?), ref: 02B5632A
GetProcAddress.KERNEL32(00000000,?), ref: 02B563B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 02B56405

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 1fd478efc5f7d7496d60df26afc701fa52369907fa63459e71fa09f7282f437e
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: EE414B71A00229ABDB14CF58C884BADB7B8EF04358F58C1A9ED65DB290E775E941CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 02B593AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 02B593C6
GetModuleFileNameA.KERNEL32(00000000), ref: 02B593CD
CharToOemA.USER32(?,?), ref: 02B593DB
wsprintfA.USER32 ref: 02B59410

Part of subcall function 02B592CB: GetTempPathA.KERNEL32(00000400,?), ref: 02B592E2
Part of subcall function 02B592CB: wsprintfA.USER32 ref: 02B59350
Part of subcall function 02B592CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02B59375
Part of subcall function 02B592CB: lstrlen.KERNEL32(?,?,00000000), ref: 02B59389
Part of subcall function 02B592CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 02B59394
Part of subcall function 02B592CB: CloseHandle.KERNEL32(00000000), ref: 02B5939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02B59448

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: b4dd5066b3f831080d11651bedd2daacdd709c23aebc9d756d7baea4c6ad93af
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 4E0152F6900128BBD721A7619D49FDF777CDB95701F0040A1BB49E6080DAB49AC58F75

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 02B528EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 02B528FA
gethostbyname.WS2_32(u6A), ref: 02B52906

Strings

u6A, xrefs: 02B528EC, 02B528F9, 02B52905
time_cfg, xrefs: 02B528EB

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: f2cb01cfafcb314e32b9fd1b2dfc3bd6be1cccf9f883c16c21cbba3d20415df8
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 47E08C306051618FCB008B28F888BC537A4EF0A230F0081D0F850CB2A0C738AC809640

Function 02B569C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 02B569E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 02B56A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 02B56A3A
CloseHandle.KERNEL32(000000FF), ref: 02B56BD8

Part of subcall function 02B5EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02B51DCF,?), ref: 02B5EEA8
Part of subcall function 02B5EE95: HeapFree.KERNEL32(00000000), ref: 02B5EEAF

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: f29b49ba9a9fa83c59118a2672c2f884d8b185b02f11fbefcdcd9691d20d2d40
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 3C711971D0062DEFDF10DFA4CC81AEEBBB9FB08354F5045AAE915AA190D7309E92DB50

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 02B5E2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02B5E50A,00000000,00000000,00000000,00020106,00000000,02B5E50A,00000000,000000E4), ref: 02B5E319
RegSetValueExA.ADVAPI32(02B5E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 02B5E38E
RegDeleteValueA.ADVAPI32(02B5E50A,?,?,?,?,?,000000C8,004122F8), ref: 02B5E3BF
RegCloseKey.ADVAPI32(02B5E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,02B5E50A), ref: 02B5E3C8

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 21b8b5475965f774b3a5f34a68cf72b1e70803cd7be8018dde5209d300b54d85
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 20214B71A00229ABDB219FA4EC89FEE7F69EF09750F048061E904AA150E371CA54DBA0

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 02B541F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02B5421F
GetLastError.KERNEL32 ref: 02B54229
WaitForSingleObject.KERNEL32(?,?), ref: 02B5423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B5424D

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 19977e573e04b1bd92cf5eeb1ba45912bf89efef39118d9a102019de6cf14f5a
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 59010872521129AFDF01DF91ED84BEF7BBCEB08255F0080A1F901E6050DB71DA958BB6

Function 02B5417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02B541AB
GetLastError.KERNEL32 ref: 02B541B5
WaitForSingleObject.KERNEL32(?,?), ref: 02B541C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B541D9

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 23609a2046eaa358f3f743a2f21faad7016d9ccf15516880e1232544d9d92b44
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 9301E97651111AABDF01DF90EE84BEE7F7CEB18295F0040A1F901E6150D7709AA48BB5

Function 02B5E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 02B5E066

Strings

A, xrefs: 02B5E07F
A, xrefs: 02B5E037, 02B5E03C
A, xrefs: 02B5E036

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 304e62cb1e815738cfdc1a867fe6c90ba9e692a4517d248ba35602231ac55aa0
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: D7F062716007229BCB20CF25D884B82B7E9FF05325B4886ABE954D7060D374E599CB51

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 02B58330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 02B583C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 02B58477

Part of subcall function 02B569C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 02B569E5
Part of subcall function 02B569C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 02B56A26
Part of subcall function 02B569C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 02B56A3A

Part of subcall function 02B5EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02B51DCF,?), ref: 02B5EEA8
Part of subcall function 02B5EE95: HeapFree.KERNEL32(00000000), ref: 02B5EEAF

Strings

C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 02B5848C, 02B584A1

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe
API String ID: 359188348-3787335913
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 974c5878f9d1d59e44bcc17344448678045e32200bb72f7877cc34d81fff1557
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 0C4150B2901129BFEB20EBA49D80FFF776DEB04344F1844E6ED44DA010EBB05A958F64

Function 02B5AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02B5AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 02B5B00D

Part of subcall function 02B5AF6F: gethostname.WS2_32(?,00000080), ref: 02B5AF83
Part of subcall function 02B5AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 02B5AFE6

Part of subcall function 02B5331C: gethostname.WS2_32(?,00000080), ref: 02B5333F
Part of subcall function 02B5331C: gethostbyname.WS2_32(?), ref: 02B53349

Part of subcall function 02B5AA0A: inet_ntoa.WS2_32(00000000), ref: 02B5AA10

Strings

%OUTLOOK_BND_, xrefs: 02B5B076, 02B5B07B, 02B5B0BE, 02B5B0DD

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 24b8dd59228d83e88bb8fa630d0a7a2cd55a671c18253699521c91cbd7880320
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: F1417F7290021CABDB21EFA0DC45FEE3BADFF08304F184466FE2496151EA75E6848F54

Function 02B59452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 02B59536
Sleep.KERNEL32(000001F4), ref: 02B5955D

Strings

, xrefs: 02B594D9

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 9a5e7433e88636841f9b80378e79d2d33763fc5db1975a9e905e11784dd53e5d
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: E94125718087A4EFFB369B64E88C7B63BA5DB02314F1800E5DC869F1A3D7B44981C7A1

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 02B5BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B5B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 02B5BA3A
InterlockedIncrement.KERNEL32(?), ref: 02B5BA94
GetTickCount.KERNEL32 ref: 02B5BB79
GetTickCount.KERNEL32 ref: 02B5BB99
InterlockedIncrement.KERNEL32(?), ref: 02B5BE15
closesocket.WS2_32(00000000), ref: 02B5BEB4

Strings

%FROM_EMAIL, xrefs: 02B5BC7D

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 2745e1a50f3263b21da9ef9321407d3b293225ed50c16e525fc9b0da92b77ab9
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 4A317A71400298DFDF25DFA4DC84BEDB7A9EB48704F2444AAFE249A1A4DB70DA85CF10

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 02B5709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 02B570BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 02B570F4

Strings

|, xrefs: 02B570E6

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 51b46af6d8d71093b0323f56cc65824b60e02372a8945f8214c88a8546e72919
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 1611FA72A00128EBDB11DBD6DC84FDEB7BDEB04715F1441A6E901EA194DB709B88DBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000C.00000002.2151244211.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 02B53189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02B52F88: GetModuleHandleA.KERNEL32(?), ref: 02B52FA1
Part of subcall function 02B52F88: LoadLibraryA.KERNEL32(?), ref: 02B52FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B531DA
HeapFree.KERNEL32(00000000), ref: 02B531E1

Memory Dump Source

Source File: 0000000C.00000002.2152673775.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2b50000_fzzrueiu.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: f19a6042535d841ac1d19de522ab5b5547c392dec6bcfbebcd6ab75328de7c86
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 7B518E7190066AAFCB019F64D884AFAB7B5FF05344F1445E9EC96CB310E732DA59CB90

Analysis Process: svchost.exePID: 1672, Parent PID: 2640COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1809
Total number of Limit Nodes:	18

Executed Functions

Function 0058C913 Relevance: 115.1, APIs: 45, Strings: 20, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0058CA4E
closesocket.WS2_32(?), ref: 0058CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0058CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0058CCB4
WriteFile.KERNEL32(0058A4B3,?,-000000E8,?,00000000), ref: 0058CCDC
CloseHandle.KERNEL32(0058A4B3), ref: 0058CCED
wsprintfA.USER32 ref: 0058CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0058CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0058CD89
CloseHandle.KERNEL32(?), ref: 0058CD98
CloseHandle.KERNEL32(?), ref: 0058CD9D
DeleteFileA.KERNEL32(?), ref: 0058CDC4
CloseHandle.KERNEL32(0058A4B3), ref: 0058CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0058CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0058CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0058D033
lstrcatA.KERNEL32(?,03D00108), ref: 0058D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0058D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0058D171
WriteFile.KERNEL32(00000000,03D0012C,?,?,00000000), ref: 0058D195
CloseHandle.KERNEL32(00000000), ref: 0058D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0058D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0058D231
lstrcatA.KERNEL32(?,03D00108,?,?,?,?,?,?,?,00000100), ref: 0058D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0058D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0058D2C7
WriteFile.KERNEL32(00000000,03D0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0058D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0058D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0058D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0058D372
lstrcatA.KERNEL32(?,03D00108,?,?,?,?,?,?,?,00000100), ref: 0058D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0058D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0058D408
WriteFile.KERNEL32(00000000,03D0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0058D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0058D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0058D45B
CreateProcessA.KERNEL32(?,00590264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0058D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0058D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0058D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0058D513
closesocket.WS2_32(?), ref: 0058D56C
Sleep.KERNEL32(000003E8), ref: 0058D577
ExitProcess.KERNEL32 ref: 0058D583
wsprintfA.USER32 ref: 0058D81F

Part of subcall function 0058C65C: send.WS2_32(00000000,?,00000000), ref: 0058C74B

closesocket.WS2_32(?), ref: 0058DAD5

Strings

flags_upd, xrefs: 0058CE4A
C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 0058CC10, 0058CCF3, 0058D975, 0058D98E
srv_time, xrefs: 0058CABB
lid_file_upd, xrefs: 0058CE6A
X Y, xrefs: 0058C927, 0058C93C, 0058C9BE
time_cfg, xrefs: 0058C95B, 0058C962, 0058C971, 0058C984
wtm_c, xrefs: 0058C956
\, xrefs: 0058D39D
wtm_w, xrefs: 0058C96C
.dat, xrefs: 0058D0D7, 0058D138, 0058D1AE, 0058D1D4, 0058D28E, 0058D308, 0058D3CF, 0058D441
@, xrefs: 0058D754
localcfg, xrefs: 0058CA89, 0058CA93, 0058CAC0, 0058CAD2, 0058CE4F, 0058CE6F, 0058D8D3, 0058D8FC
local_time, xrefs: 0058CACD
.sys, xrefs: 0058D0CC
wtm_r, xrefs: 0058C97F
4, xrefs: 0058D9F7
\, xrefs: 0058D3A7
work_srv, xrefs: 0058D607, 0058D60F, 0058D62C
except_info, xrefs: 0058D8CD, 0058D8D2, 0058D8FB
drivers\, xrefs: 0058D067

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe$X Y$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-2390319092
Opcode ID: 7781c3d97f396bbb689f91ce98b6baca12b06632dd338128ca108afe067554fb
Instruction ID: ebe41fa9bd2920666ed8ae82bb2780258b2fd70a5abc89109cfe1e0f33084d6c
Opcode Fuzzy Hash: 7781c3d97f396bbb689f91ce98b6baca12b06632dd338128ca108afe067554fb
Instruction Fuzzy Hash: 65B29572900209AFEB21BF64DC49EEE7FBDFB54304F15046AF905B6191E7309A49DB60

Function 00589A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00589A7F
SetErrorMode.KERNELBASE(00000003), ref: 00589A83
SetUnhandledExceptionFilter.KERNEL32(00586511), ref: 00589A8A

Part of subcall function 0058EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0058EC5E
Part of subcall function 0058EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0058EC72
Part of subcall function 0058EC54: GetTickCount.KERNEL32 ref: 0058EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00589AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00589ABA
GetCommandLineA.KERNEL32 ref: 00589AFD
lstrlenA.KERNEL32(?), ref: 00589B99
ExitProcess.KERNEL32 ref: 00589C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00589CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00589D7A
lstrcatA.KERNEL32(?,?), ref: 00589D8B
lstrcatA.KERNEL32(?,0059070C), ref: 00589D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00589DED
DeleteFileA.KERNEL32(00000022), ref: 00589E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00589E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00589EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00589ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00589F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00589F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00589F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00589FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00589FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00589FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0058A038
lstrcatA.KERNEL32(00000022,00590A34), ref: 0058A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0058A072
lstrcatA.KERNEL32(00000022,00590A34), ref: 0058A08D
wsprintfA.USER32 ref: 0058A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0058A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0058A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0058A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0058A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0058A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0058A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0058A1B6
GetCommandLineA.KERNEL32 ref: 0058A1E5

Part of subcall function 005899D2: lstrcpyA.KERNEL32(?,?,00000100,005922F8,00000000,?,00589E9D,?,00000022,?,?,?,?,?,?,?), ref: 005899DF
Part of subcall function 005899D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00589E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00589A3C
Part of subcall function 005899D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00589E9D,?,00000022,?,?,?), ref: 00589A52

lstrlenA.KERNEL32(?), ref: 0058A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0058A3B7
GetLastError.KERNEL32 ref: 0058A3ED
Sleep.KERNEL32(000003E8), ref: 0058A400
DeleteFileA.KERNELBASE(005933D8), ref: 0058A407
CreateThread.KERNELBASE(00000000,00000000,0058405E,00000000,00000000,00000000), ref: 0058A42C
WSAStartup.WS2_32(00001010,?), ref: 0058A43A
CreateThread.KERNELBASE(00000000,00000000,0058877E,00000000,00000000,00000000), ref: 0058A469
Sleep.KERNELBASE(00000BB8), ref: 0058A48A
GetTickCount.KERNEL32 ref: 0058A49F
GetTickCount.KERNEL32 ref: 0058A4B7
Sleep.KERNELBASE(00001A90), ref: 0058A4C3

Strings

D, xrefs: 00589F8E
\, xrefs: 00589D0C
", xrefs: 0058A189
C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 0058A1D9
", xrefs: 0058A078
P, xrefs: 00589DAA
%X%08X, xrefs: 0058A0B0
miqllcjz, xrefs: 0058A389, 0058A397
", xrefs: 00589EDB

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe$D$P$\$miqllcjz
API String ID: 2089075347-2458650493
Opcode ID: c407cce1cf1d463f871b37824686967aeb469a5ebb5a7450f306ee685f502e40
Instruction ID: 060619480c35d2847f1a39acd72aa55dcb010cfcffb5f4d40d3d5e1eb00efafb
Opcode Fuzzy Hash: c407cce1cf1d463f871b37824686967aeb469a5ebb5a7450f306ee685f502e40
Instruction Fuzzy Hash: 1B5272B1D40259AFDF21ABA0CC4EEEE7FBCBB54300F1444A6F909B6141E7719A48DB61

Function 0058199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 005819B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,00581E9E), ref: 005819BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 005819E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 005819ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 005819F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,00581E9E), ref: 00581A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00581E9E), ref: 00581A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00581E9E), ref: 00581A36
GetAdaptersInfo.IPHLPAPI(00000000,00581E9E,?,?,?,?,00000001,00581E9E), ref: 00581A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,00581E9E,?,?,?,?,00000001,00581E9E), ref: 00581A5A
GetAdaptersInfo.IPHLPAPI(00000000,00581E9E,?,?,?,?,00000001,00581E9E), ref: 00581A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00581E9E), ref: 00581A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00581E9E), ref: 00581AA4

Strings

localcfg, xrefs: 005819A3
Iphlpapi.dll, xrefs: 005819B7
GetAdaptersInfo, xrefs: 005819DC
123.45.67.89, xrefs: 005819A6
GetBestInterface, xrefs: 005819EF
GetIfEntry, xrefs: 005819E4

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 653d066575966717608f986349aab1264b1df42c71b04e7eb88ef034f445f410
Instruction ID: 3c2e6e288e4c51ba382ed26a09a8759e65afde84ec2090469bf2c65ab81454b0
Opcode Fuzzy Hash: 653d066575966717608f986349aab1264b1df42c71b04e7eb88ef034f445f410
Instruction Fuzzy Hash: BA316936A01219AFCF15AFE0CD888BEBFBDFF54311B15096AE901B2160D7304E42EB94

Function 00587A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00587ABA
GetUserNameA.ADVAPI32(?,?), ref: 00587ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0059070C,?,?,?), ref: 00587B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00587B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00587B59
EqualSid.ADVAPI32(?,00000022), ref: 00587B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00587B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00587B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00587B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 00587BAB
LocalFree.KERNEL32(00000000), ref: 00587BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00587FC9,?,00000000), ref: 00587BCE

Strings

D, xrefs: 00587B0C
C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 00587CE2, 00587D0F, 00587D23, 00587D24

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe$D
API String ID: 2976863881-2072606513
Opcode ID: 5f3fc819eb4516516f305a968a1468d181cc69e072b252794bce723e18203b28
Instruction ID: 2d1576e383e4d62c83bf51539e2e72f5bfdc624a34ce739cb5cee7e546d03ff8
Opcode Fuzzy Hash: 5f3fc819eb4516516f305a968a1468d181cc69e072b252794bce723e18203b28
Instruction Fuzzy Hash: F2A12971A0421DAFDF119FA0CC88EEEBFB9FB48300F15446AE905B2190E731DA45DB60

Function 00587809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0058782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00587866
GetLengthSid.ADVAPI32(?), ref: 00587878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0058789A
GetSecurityDescriptorOwner.ADVAPI32(?,00587F63,?), ref: 005878B8
EqualSid.ADVAPI32(?,00587F63), ref: 005878D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 005878E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005878F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00587901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00587910
LocalFree.KERNEL32(00000000), ref: 00587917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00587933
GetAce.ADVAPI32(?,00000000,?), ref: 00587963
EqualSid.ADVAPI32(?,00587F63), ref: 0058798A
DeleteAce.ADVAPI32(?,00000000), ref: 005879A3
EqualSid.ADVAPI32(?,00587F63), ref: 005879C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00587A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00587A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00587A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00587A79
LocalFree.KERNEL32(00000000), ref: 00587A87

Strings

D, xrefs: 0058785C

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 70ba1aa99f512af52b12215458bc58d061cb89079081230bef74b2c999e92a0a
Instruction ID: 058c3d89592fd1c0f6f7ff1b89f802fd3fe2ad26b146cd3568c7aee257e9113e
Opcode Fuzzy Hash: 70ba1aa99f512af52b12215458bc58d061cb89079081230bef74b2c999e92a0a
Instruction Fuzzy Hash: 2281277290421EAFDB21DFA4CD49BEEBBB8FB08340F25446AE905F2150E734CA45DB60

Function 00588328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 005883F3
RegQueryValueExA.KERNELBASE(00590750,?,00000000,?,00588893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00588414
RegSetValueExA.KERNELBASE(00590750,?,00000000,00000004,00588893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00588441
RegCloseKey.ADVAPI32(00590750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0058844A

Strings

localcfg, xrefs: 00588348
C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 005885C8, 005885D5, 005885E5

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe$localcfg
API String ID: 237177642-601414241
Opcode ID: d8924530179bdae18347da08b1e128527021ed65cb85c22c84ea828631c50754
Instruction ID: 430f22cf4160da946a2ef43a2b1055f781505ced728d4145907b7326d809b95f
Opcode Fuzzy Hash: d8924530179bdae18347da08b1e128527021ed65cb85c22c84ea828631c50754
Instruction Fuzzy Hash: 22C170B2940109BEEF11BBA49C8AEFE7FBCFB54304F540466F905B2091EA715E489B61

Function 00581D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 00581DC6
GetSystemInfo.KERNELBASE(?), ref: 00581DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00581E03
GetProcAddress.KERNEL32(00000000), ref: 00581E0A
GetCurrentProcess.KERNEL32(?), ref: 00581E1B
GetTickCount.KERNEL32 ref: 00581FC9

Part of subcall function 00581BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00581C15

Strings

hi_id, xrefs: 00581F16, 00581F1B, 00581F33
flags_upd, xrefs: 00581E3E, 00581E43, 00581E7C
net_type, xrefs: 00581E87
localcfg, xrefs: 00581E2A, 00581E31, 00581E44, 00581E7D, 00581E8C, 00581EB2, 00581ED1, 00581EE7, 00581EFF, 00581F1C, 00581F34, 00581F50, 00581F70
kernel32, xrefs: 00581DF7
lid_file_upd, xrefs: 00581E25
start_srv, xrefs: 00581E6C
born_date, xrefs: 00581EAD, 00581ECC
IsWow64Process, xrefs: 00581DF2
work_srv, xrefs: 00581E5E
loader_id, xrefs: 00581F4B, 00581F6B

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 41fa7e782ebbd2832583e243fea4ee611d56690d3304ef2b59c841e792021a9f
Instruction ID: 09bf2267c5aa5562c7239cbd4e0b603ab6ed455c1da86384dcab7694a35bedb1
Opcode Fuzzy Hash: 41fa7e782ebbd2832583e243fea4ee611d56690d3304ef2b59c841e792021a9f
Instruction Fuzzy Hash: B551A1B09047456FE720BF758C8AF2BBEECFB94704F040D1DB986A2282D674A904C765

Function 005873FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00587472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 005874F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00587528
___ascii_stricmp.LIBCMT ref: 0058764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 005876E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00587706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00587717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00587745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 005877EF

Part of subcall function 0058F1A5: lstrlenA.KERNEL32(000000C8,000000E4,005922F8,000000C8,00587150,?), ref: 0058F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0058778F
RegCloseKey.KERNELBASE(?), ref: 005877E6

Strings

", xrefs: 00587599

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: c22eea839b5cd66f703b493ab1960e2f2f83c88037c9c6ee6e960ab25fc89fbf
Instruction ID: afd85d9e6d04bcc5c676546a0990324f98b86628490a6629ae37d67318d617ab
Opcode Fuzzy Hash: c22eea839b5cd66f703b493ab1960e2f2f83c88037c9c6ee6e960ab25fc89fbf
Instruction Fuzzy Hash: 6CC1617290420AAFDB11ABA5DC4ABEE7FB9FF49310F240495F904F6191EB71DA44CB60

Function 0058675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0058677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0058679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 005867B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 005867BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 005867D3
ReadFile.KERNELBASE(000000FF,?,00000040,00588244,00000000,?,75920F10,00000000), ref: 00586807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0058681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0058683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0058685C
ReadFile.KERNEL32(000000FF,?,00000028,00588244,00000000,?,75920F10,00000000), ref: 0058688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00586906
ReadFile.KERNEL32(000000FF,?,00000000,00588244,00000000,?,75920F10,00000000), ref: 0058691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,75920F10,00000000), ref: 00586971

Part of subcall function 0058EC2E: GetProcessHeap.KERNEL32(00000000,'X,00000000,0058EA27,00000000), ref: 0058EC41
Part of subcall function 0058EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0058EC48

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 42f8cd85d1d3bb6c91b3409b81e612ddccc991738dacf22fd3087a4223b8b28c
Instruction ID: a53bf09cd89c69d95c8685b253694d3d9e6a57821334bc3f12c123bc2e4a1c26
Opcode Fuzzy Hash: 42f8cd85d1d3bb6c91b3409b81e612ddccc991738dacf22fd3087a4223b8b28c
Instruction Fuzzy Hash: 4D71F571D0021EEFDF11AFA4CC84AEEBBB9FB04314F10456AE915B6190E7309E96DB60

Function 0058F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(0058CA1D), ref: 0058F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0058F367
closesocket.WS2_32(00000000), ref: 0058F375

Strings

time_cfg, xrefs: 0058F323

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: dd4657f16ce9f91dfb4f8cbbe5d5ea126d3412df298d9be33060f9e31a790ba5
Instruction ID: dcc97a26ab9fca7caa1278750a404f593082302e7ee6f39c67ed3525239aa910
Opcode Fuzzy Hash: dd4657f16ce9f91dfb4f8cbbe5d5ea126d3412df298d9be33060f9e31a790ba5
Instruction Fuzzy Hash: 42316B76900119AFDB10AFA8DC899EF7BBCFF88310F104566F915E2150E7309A459BA0

Function 0058405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00584070
ExitProcess.KERNEL32 ref: 00584121

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 65c1e5cb14e085bb84b3e5ccbe076626655d7e8ca4e5cbe9454b3e1c7d3c4a1b
Instruction ID: 7dd3469f2095decf16105d29ffd14f44c5e7757b3ee9d7f587a348bb9f828171
Opcode Fuzzy Hash: 65c1e5cb14e085bb84b3e5ccbe076626655d7e8ca4e5cbe9454b3e1c7d3c4a1b
Instruction Fuzzy Hash: 1A517FB1D0021ABAEB20BBA08C4AFAF7E7CFB60714F110055FE05B6190E7358A45DBA1

Function 00582D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00582F01,?,005820FF,00592000), ref: 00582D3A
LoadLibraryA.KERNEL32(?), ref: 00582D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00582D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 00582D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00582D99
HeapAlloc.KERNEL32(00000000), ref: 00582DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00582DCB

Strings

dnsapi.dll, xrefs: 00582D29
DnsQuery_A, xrefs: 00582D5B

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: 275b160afd1f5c4554a106f49e44444578b76f199fe2d99a9002a6836874fd13
Instruction ID: 8fc6ef1f969d435bfc39289bc99c8c50b3c770afbf91c5fce9fe98f7bec0d583
Opcode Fuzzy Hash: 275b160afd1f5c4554a106f49e44444578b76f199fe2d99a9002a6836874fd13
Instruction Fuzzy Hash: 2F218E71902226ABCB21AF64DC489AEBFBCFF18B50F114815FD45F3150D370998697D0

Function 005880C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0058815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0058A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00588187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0058A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 005881BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00588210

Part of subcall function 0058675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0058677E
Part of subcall function 0058675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0058679A
Part of subcall function 0058675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 005867B0
Part of subcall function 0058675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 005867BF
Part of subcall function 0058675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 005867D3
Part of subcall function 0058675C: ReadFile.KERNELBASE(000000FF,?,00000040,00588244,00000000,?,75920F10,00000000), ref: 00586807
Part of subcall function 0058675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0058681F
Part of subcall function 0058675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0058683E
Part of subcall function 0058675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0058685C

Part of subcall function 0058EC2E: GetProcessHeap.KERNEL32(00000000,'X,00000000,0058EA27,00000000), ref: 0058EC41
Part of subcall function 0058EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0058EC48

Strings

C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe, xrefs: 00588225, 0058823A

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe
API String ID: 124786226-3787335913
Opcode ID: 03eda99383b8268a0778d7df242bdf8a323f480bca13fec8fb102df896d93464
Instruction ID: 4d07ac069df98068793f2eb67408c42fd03dac09e054bce4db72daee212b4b34
Opcode Fuzzy Hash: 03eda99383b8268a0778d7df242bdf8a323f480bca13fec8fb102df896d93464
Instruction Fuzzy Hash: 77417FB6901109BFEB11FBA49D89DBE7F7CFB54300F54086AE906B2051EA309E48DB51

Function 00581AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00581AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00581AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00581B20

Strings

Iphlpapi.dll, xrefs: 00581ACC
GetAdaptersAddresses, xrefs: 00581AE3

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 26eff1b918f4d08515724f96518145624d0cfa770d8afc786edda5f806430965
Instruction ID: 3a654ddf55c0f9f6426555b01f01966e526172d5df8371c004e70c3946b470c0
Opcode Fuzzy Hash: 26eff1b918f4d08515724f96518145624d0cfa770d8afc786edda5f806430965
Instruction Fuzzy Hash: 98110372E01538AFCF11ABA4DC898EDBFBDFB44B12F144456E805B3140E6304E42DB88

Function 0058E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,0058E5F2,00000000,00020119,0058E5F2,005922F8), ref: 0058E3E6
RegQueryValueExA.ADVAPI32(0058E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0058E44E
RegQueryValueExA.ADVAPI32(0058E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0058E482
RegQueryValueExA.ADVAPI32(0058E5F2,?,00000000,?,80000001,?), ref: 0058E4CF
RegCloseKey.ADVAPI32(0058E5F2,?,?,?,?,000000C8,000000E4), ref: 0058E520

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 54e644cccac219e524b0f1731c4c405ab224b9c23887fd3358fd3acd60f7b8df
Instruction ID: ee392fd0bd90139581b37b30601ac3b4a2f11190b37d37274e10e7f4cd747004
Opcode Fuzzy Hash: 54e644cccac219e524b0f1731c4c405ab224b9c23887fd3358fd3acd60f7b8df
Instruction Fuzzy Hash: 8E4107B2D0021ABFDF11AF94DC86DEEBBB9FB58304F544466EA10B2160E3319A159B60

Function 0058F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0058F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0058F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0058F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0058F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0058F2FD

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 79054fabe0cb148d5e019f4a20e3de9007cecf1e7f42df2e0df36cfee9a494f4
Instruction ID: d3936213ddee4e6d3f0ae7ca6b7be78a3f55efaee016c78ede5d77cf4ea10c2f
Opcode Fuzzy Hash: 79054fabe0cb148d5e019f4a20e3de9007cecf1e7f42df2e0df36cfee9a494f4
Instruction Fuzzy Hash: 2A11FBB5A40248BAEF11DF94CD45F9E7FBCEB44751F004066BB04EA1D0E6B19A44DB94

Function 00581BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00581AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00581AD4
Part of subcall function 00581AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00581AE9
Part of subcall function 00581AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00581B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00581C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00581C51

Strings

hi_id, xrefs: 00581BE5
localcfg, xrefs: 00581BE7

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 5684e109526f56f9a5d6537b146ffb81a7d0438103d6ff83c584b5cfe934645f
Instruction ID: f49fdb926d54835eb1ab36b78d792f3dcd77d36738eadefaca53b4e511f96c77
Opcode Fuzzy Hash: 5684e109526f56f9a5d6537b146ffb81a7d0438103d6ff83c584b5cfe934645f
Instruction Fuzzy Hash: 56018076A40518BFEB10EAE8C8C59EFBBBCBB44745F100876EA02F3140D2309E4587A4

Function 00581B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00581AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00581AD4
Part of subcall function 00581AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00581AE9
Part of subcall function 00581AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00581B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00581BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,00581EFD,00000000,00000000,00000000,00000000), ref: 00581BB8

Strings

localcfg, xrefs: 00581B7B

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 57543e23e8cbe084c7432cffc31a240ca8ae4305c62b30246b9bf1e8956b395e
Instruction ID: 0d3b9ac4b0d6d245f421403409f99ef451e6abf9db43cae4fa88ec789ff5e3f3
Opcode Fuzzy Hash: 57543e23e8cbe084c7432cffc31a240ca8ae4305c62b30246b9bf1e8956b395e
Instruction Fuzzy Hash: AE018BB7D00108BFEB00ABE9CC869EFFBBCAB98650F150462AA01F3180D5705E0947A0

Function 00582684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00582693
gethostbyname.WS2_32(00000001), ref: 0058269F

Strings

time_cfg, xrefs: 00582684

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: b4da168f6d623f848320548380282449580b4f9bdb756941f2b0837f5924ebc7
Instruction ID: 68eea8ea187767086e5b54ca84c7c8e3edf48b6c7b63fa4dc70b3cc8abddd1e4
Opcode Fuzzy Hash: b4da168f6d623f848320548380282449580b4f9bdb756941f2b0837f5924ebc7
Instruction Fuzzy Hash: 26E0C2306040118FDB50AB28F848AC57FE4FF16330F025582F840E71A0EB30DC809780

Function 0058EC2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0058EBA0: GetProcessHeap.KERNEL32(00000000,00000000,0058EC0A,00000000,80000001,?,0058DB55,7FFF0001), ref: 0058EBAD
Part of subcall function 0058EBA0: HeapSize.KERNEL32(00000000,?,0058DB55,7FFF0001), ref: 0058EBB4

GetProcessHeap.KERNEL32(00000000,'X,00000000,0058EA27,00000000), ref: 0058EC41
RtlFreeHeap.NTDLL(00000000), ref: 0058EC48

Strings

'X, xrefs: 0058EC2F, 0058EC37, 0058EC3E

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID: 'X
API String ID: 1305341483-3238454649
Opcode ID: 8ce98e695d8c2c5ca3f5bd21a43b98af1b3d671d5953ef9fb10f29332ad80292
Instruction ID: 116344153c44c434d2704976259135cda15c0dc48c530fe32535a4f923e79553
Opcode Fuzzy Hash: 8ce98e695d8c2c5ca3f5bd21a43b98af1b3d671d5953ef9fb10f29332ad80292
Instruction Fuzzy Hash: 2EC012329062306FC5513B50BC0EF9B6F2CAF96712F0A080AF8057609487605C40A7E1

Function 0058E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0058DD05: GetTickCount.KERNEL32 ref: 0058DD0F
Part of subcall function 0058DD05: InterlockedExchange.KERNEL32(005936B4,00000001), ref: 0058DD44
Part of subcall function 0058DD05: GetCurrentThreadId.KERNEL32 ref: 0058DD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,0058A445), ref: 0058E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,75920F10,?,00000000,?,0058A445), ref: 0058E583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,0058A445), ref: 0058E5B2

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 231f32a356e569102fc18f170ff1ec3d495f3ae4a5d2d85b0941d323f39ba708
Instruction ID: 0d9895854fa968b310085b6f5b62129f870d1fbab5f8e6cf181b308f277bd582
Opcode Fuzzy Hash: 231f32a356e569102fc18f170ff1ec3d495f3ae4a5d2d85b0941d323f39ba708
Instruction Fuzzy Hash: 4921B2B26803027AE62077259C4FFAB3E6CFBE5750F110514BE09B51E3EA51E91493F1

Function 0058877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 005888A5

Part of subcall function 0058F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0058E342,00000000,7508EA50,80000001,00000000,0058E513,?,00000000,00000000,?,000000E4), ref: 0058F089
Part of subcall function 0058F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0058E342,00000000,7508EA50,80000001,00000000,0058E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0058F093

Strings

localcfg, xrefs: 005887CA, 005887CF, 005887FB, 00588835, 00588861
rresolv, xrefs: 005887F6, 0058885C

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 88142fb961e25018511e947993d218f7554837fb001ef81a46843f4f99c1ec53
Instruction ID: 055d175fa00a7e97c8f756c2b0efa9fc169294c5016535c3915338c12b9b561f
Opcode Fuzzy Hash: 88142fb961e25018511e947993d218f7554837fb001ef81a46843f4f99c1ec53
Instruction Fuzzy Hash: 0E2184325483027EF714B7666D4FB7A3EA8FB95724FD1081AFD04B50C3EEA155848BA2

Function 00584000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,005922F8,005842B6,00000000,00000001,005922F8,00000000,?,005898FD), ref: 00584021
GetLastError.KERNEL32(?,005898FD,00000001,00000100,005922F8,0058A3C7), ref: 0058402C
Sleep.KERNEL32(000001F4,?,005898FD,00000001,00000100,005922F8,0058A3C7), ref: 00584046

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: a869109e8d2485e37e850764629cb5dbe5c405bbd2946684180826a09a1a539b
Instruction ID: 3f0e7e87c537b9466001d454c3ef4638e7a9089648de5d293bc55ee1ad44a5c8
Opcode Fuzzy Hash: a869109e8d2485e37e850764629cb5dbe5c405bbd2946684180826a09a1a539b
Instruction Fuzzy Hash: 5DF08931240142DED7311B24AC4D71B3A55FB81724F674A15FBB5F90E0C63048855F14

Function 0058DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0058DC19,?,00000104), ref: 0058DB7F
lstrcpyA.KERNEL32(?,005928F8), ref: 0058DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 0058DBC2

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: 397721681704cc8534790ef9eed149b8bdac8473227daa948ee6da48b175c8e6
Instruction ID: 2ae06c628ae9792f2b3160c85e78f5dfb1f4e0436d21c10d68296da1e7dba3a2
Opcode Fuzzy Hash: 397721681704cc8534790ef9eed149b8bdac8473227daa948ee6da48b175c8e6
Instruction Fuzzy Hash: 8EF0B470100209AFEF10DF64DC49FD93BA9BB10308F504594BB51A40D0D7F2D549DF20

Function 0058EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0058EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0058EC72
GetTickCount.KERNEL32 ref: 0058EC78

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 9949af495af00d75c3138f62790467b83b6ab317c87e462caa4078e2df4c54d8
Instruction ID: a5c3581bff09d8dd0ce6b482981ff08c59eecbbdba9fc42a1ec8783a6fb049d6
Opcode Fuzzy Hash: 9949af495af00d75c3138f62790467b83b6ab317c87e462caa4078e2df4c54d8
Instruction Fuzzy Hash: A5E09AF5810204BFEB01ABB0DC4EE6B77BCEB18314F910A51B911D60E0DA749A089B60

Function 005830B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 005830D8
gethostbyname.WS2_32(?), ref: 005830E2

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 3f48e61a82d1159d543afbc26c30126292fbbf07ff6c9cc2d96380dd7dcea2cd
Instruction ID: 5aa6fc86dfef7240d0e35904f1ddef87f6e34f272a0b83742789848b1999a0ab
Opcode Fuzzy Hash: 3f48e61a82d1159d543afbc26c30126292fbbf07ff6c9cc2d96380dd7dcea2cd
Instruction Fuzzy Hash: 15E065759001199FCF10ABA8EC89F9A7BACBB04304F080461F905E3290EA34E5088790

Function 0058EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0058EBFE,7FFF0001,?,0058DB55,7FFF0001), ref: 0058EBD3
RtlAllocateHeap.NTDLL(00000000,?,0058DB55,7FFF0001), ref: 0058EBDA

Part of subcall function 0058EB74: GetProcessHeap.KERNEL32(00000000,00000000,0058EC28,00000000,?,0058DB55,7FFF0001), ref: 0058EB81
Part of subcall function 0058EB74: HeapSize.KERNEL32(00000000,?,0058DB55,7FFF0001), ref: 0058EB88

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: 98411cf3d67f69e0ad4c252b904f1b7641645929c5408e194547f73e2af2f4c0
Instruction ID: dcc1498a7338356231033e67841fce421bc9d49d246a5e689540b32524ec787c
Opcode Fuzzy Hash: 98411cf3d67f69e0ad4c252b904f1b7641645929c5408e194547f73e2af2f4c0
Instruction Fuzzy Hash: 2BC080321042206FC60137E47C0DE9A3E5CEF84363F050405F505C11B4C7304840E795

Function 0058F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,0058CA44), ref: 0058F476

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 784a89f9832504f2e9d3ca350d0028e39c3cae4640b79d949674e3201021d7d1
Instruction ID: 79252aa8416410431230d8ae3e24bb48414f5cbf62036cb17d5ee4cfe2ea9cac
Opcode Fuzzy Hash: 784a89f9832504f2e9d3ca350d0028e39c3cae4640b79d949674e3201021d7d1
Instruction Fuzzy Hash: 65F01C7320155EAB9F11AE9ADC84CAB3FAEFBCD3507050522FE14E7120D631E8259BA0

Function 00581978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 00581992

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: e62d2514b6c0b0a7fe278ccb62bf71cadad2b1cbe003997f7fddd7002c76d7dc
Instruction ID: 9d2ea11be347b334f87c9a553fa7473cc0962e908aeb96b23f01320d3d9627a8
Opcode Fuzzy Hash: e62d2514b6c0b0a7fe278ccb62bf71cadad2b1cbe003997f7fddd7002c76d7dc
Instruction Fuzzy Hash: 63D012261486326A56513759BC0947FBF9CEF49662712942BFC49D0160D634CC429395

Function 0058DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 0058DDB5

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: f2c4335bfc6271ddc632fd08a7e5547a6f6cd56328da5098bc7c32ab9fe213dc
Instruction ID: a039f6b1d8eb8c64209f406d12d3d9fd3ab6eff63ce387b117377e73c456468d
Opcode Fuzzy Hash: f2c4335bfc6271ddc632fd08a7e5547a6f6cd56328da5098bc7c32ab9fe213dc
Instruction Fuzzy Hash: CEF08231202202DFCB20EE249848656BBF4FF55325F15483EE959E22D0D730DC49CB31

Non-executed Functions

Function 0058637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00589816,EntryPoint), ref: 0058638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00589816,EntryPoint), ref: 005863A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 005863CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 005863EB

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: ff4733b02c8d15779f74a55f7a7b2e247b1b73b51573a4d44f1cbf5439558e36
Instruction ID: 6e36afcbc618f23341d4f0000c2daed73a6a9186beab278be52527c5d8a02040
Opcode Fuzzy Hash: ff4733b02c8d15779f74a55f7a7b2e247b1b73b51573a4d44f1cbf5439558e36
Instruction Fuzzy Hash: 7A118FB2600219BFEB119F65DC4AF9B3FA8FB047A4F114425FD05A7290DA70DC009BA0

Function 00581000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00581839,00589646), ref: 00581012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 005810C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 005810E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00581101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00581121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00581140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00581160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00581180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0058119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 005811BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 005811DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 005811FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0058121A

Strings

ntdll.dll, xrefs: 0058100D
NtSetInformationThread, xrefs: 00581155
NtQueryInformationToken, xrefs: 00581262
RtlInitUnicodeString, xrefs: 00581135
RtlExpandEnvironmentStrings_U, xrefs: 005810BC
RtlLengthSid, xrefs: 00581246
NtFilterToken, xrefs: 0058122B
NtClose, xrefs: 005811B4
RtlSetLastWin32Error, xrefs: 005810D6
NtTerminateProcess, xrefs: 005810F6
NtSetInformationToken, xrefs: 00581175
NtDuplicateToken, xrefs: 005811F3
NtOpenProcessToken, xrefs: 005811D4
RtlAllocateAndInitializeSid, xrefs: 0058120F
RtlFreeSid, xrefs: 00581116
RtlNtStatusToDosError, xrefs: 00581194

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 71cdb96c97ff4a4772c801c3d3c06410d9b8bbdeb802f437ad289af56116d2c0
Instruction ID: 760f84a82c17406a18f67e904f2edb1facd354211d53ad7c83229d3763cd5b02
Opcode Fuzzy Hash: 71cdb96c97ff4a4772c801c3d3c06410d9b8bbdeb802f437ad289af56116d2c0
Instruction Fuzzy Hash: DA516371542E12E7DB11AFADED447523AACB758720F1603179821E21F0D7F0CACAEB59

Function 0058B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0058B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0058B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0058B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0058B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0058B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0058B329
wsprintfA.USER32 ref: 0058B3B7

Strings

Apr, xrefs: 0058B26B
Jan, xrefs: 0058B256
Sat, xrefs: 0058B24F
Feb, xrefs: 0058B25D
Mon, xrefs: 0058B22C
Tue, xrefs: 0058B233
Nov, xrefs: 0058B29C
Oct, xrefs: 0058B295
Aug, xrefs: 0058B287
Jun, xrefs: 0058B279
Sep, xrefs: 0058B28E
May, xrefs: 0058B272
Thu, xrefs: 0058B241
Wed, xrefs: 0058B23A
Mar, xrefs: 0058B264
Fri, xrefs: 0058B248
Sun, xrefs: 0058B225
Jul, xrefs: 0058B280
Dec, xrefs: 0058B2A3
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0058B3AF

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 8df962e5a5ed2238e5d8ca81b71ddea00a3b11ddffd8873295c1cb5dc2219c59
Instruction ID: 3358392a09b55c14324a4d110afaf39b2b83e5bdf108194a5dc0c2e53d3628bb
Opcode Fuzzy Hash: 8df962e5a5ed2238e5d8ca81b71ddea00a3b11ddffd8873295c1cb5dc2219c59
Instruction Fuzzy Hash: 615115B2D00219AEDF14DFD4D8898EEFFF9BF48304F10592AEA11B6190D7744A89DB90

Function 00586511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0058654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0058655C
htonl.WS2_32(?), ref: 00586578
htonl.WS2_32(?), ref: 00586587
wsprintfA.USER32 ref: 0058659B
wsprintfA.USER32 ref: 005865DC
wsprintfA.USER32 ref: 00586671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0058668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00586696
wsprintfA.USER32 ref: 005866B0
wsprintfA.USER32 ref: 005866E7
wsprintfA.USER32 ref: 005866FF
wsprintfA.USER32 ref: 0058671F
ExitProcess.KERNEL32 ref: 00586755

Strings

va=%08X%08X uef=%p, xrefs: 00586595
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 005865D6
localcfg, xrefs: 0058672D
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0058666B
plgs:, xrefs: 005866AA
12:08:32, xrefs: 00586535
%d=%p, xrefs: 005866F9
ver=%d date=%s %sc=%08x a=%p, xrefs: 00586547
except_info, xrefs: 00586728
Jan 13 2018, xrefs: 0058653A

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 22df7f1dc009ceeaad4dfec3365cc6ba9bf6408e0f03357c4ef1035247ecb874
Instruction ID: 4f197fa4edca83a8073b96d808b8fecd3faa41b8f4179f612baaacd96c21a6a4
Opcode Fuzzy Hash: 22df7f1dc009ceeaad4dfec3365cc6ba9bf6408e0f03357c4ef1035247ecb874
Instruction Fuzzy Hash: DD614D72940208AFDF60AFA4DC45FEA7BF9FF48300F144469F969D21A1EA7199449F50

Function 0058A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0058A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0058A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0058A893
wsprintfA.USER32 ref: 0058A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0058A8D2
wsprintfA.USER32 ref: 0058A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0058A97C
wsprintfA.USER32 ref: 0058A9B9

Strings

ESMTP, xrefs: 0058AA38
helo %s, xrefs: 0058A803
Too small respons, xrefs: 0058A9C9
mail from:<%s>, xrefs: 0058A848
Incorrect respons, xrefs: 0058AB39
., xrefs: 0058A8CA
AUTH LOGIN, xrefs: 0058A80C
quit, xrefs: 0058A86C
data, xrefs: 0058A85E
Error sending command (sent = %d/%d), xrefs: 0058A8A7, 0058A8DA
rcpt to:<%s>, xrefs: 0058A855
Too big smtp respons (%d bytes), xrefs: 0058A9B1
localcfg, xrefs: 0058AB0B
ehlo %s, xrefs: 0058A7F5

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 8fac655bf3e0ff4981a58dd1e6ac843a5dfe7c37ce601be9873e8b8c68eaab4d
Instruction ID: 8a8142843913b1fe53941b573688a38f4d6547f9818cc5ffd4f93dc4e8ed06cb
Opcode Fuzzy Hash: 8fac655bf3e0ff4981a58dd1e6ac843a5dfe7c37ce601be9873e8b8c68eaab4d
Instruction Fuzzy Hash: 42A1D372944205AEFF21BA54DC8AFAE3F69BB50304F280827FD05B60D1EA619D48DB57

Function 00581280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0058139A
lstrlenW.KERNEL32(-00000003), ref: 00581571

Strings

, xrefs: 00581462
PDGu, xrefs: 0058139A
<, xrefs: 00581378
@, xrefs: 00581380
D, xrefs: 005815C6
%systemroot%\system32\cmd.exe, xrefs: 00581316
wusa.exe, xrefs: 00581388
useless, xrefs: 0058161E
uac, xrefs: 00581628

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 9ea12e8d5b09865ae326b85666fccf4e84c52048710533e685544c7d3cec8d03
Instruction ID: 553c70ddcf64b81f9674e5f42099f7789e88b6e0f6d42569f1ed9c03e11b646f
Opcode Fuzzy Hash: 9ea12e8d5b09865ae326b85666fccf4e84c52048710533e685544c7d3cec8d03
Instruction Fuzzy Hash: 00F1ACB5508741DFD720EF64C888B6BBBE8FB98300F00491EF986E7290D7749949CB56

Function 00582A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00582A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00582A86
socket.WS2_32(00000002,00000002,00000011), ref: 00582AA0
htons.WS2_32(00000000), ref: 00582ADB
select.WS2_32 ref: 00582B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00582B4A
htons.WS2_32(?), ref: 00582B71
htons.WS2_32(?), ref: 00582B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00582BFB

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 4449857efd79638d833f381134f7e18ff0f3e2a170765639336327519c75a277
Instruction ID: 96c8998922e1954c37d7c790f772e3515f409a1c6b0907abea3ed34a8120f0ea
Opcode Fuzzy Hash: 4449857efd79638d833f381134f7e18ff0f3e2a170765639336327519c75a277
Instruction Fuzzy Hash: ED619BB1904305AFD720AF65DC49B7EBFE8FB98751F01080AFD89A7191D7B09C449BA2

Function 0058704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 005870C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0058719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 005871B2
RegCloseKey.ADVAPI32(75920F10), ref: 00587208
RegCloseKey.ADVAPI32(75920F10), ref: 00587291
___ascii_stricmp.LIBCMT ref: 005872C2
RegCloseKey.ADVAPI32(75920F10), ref: 005872D0
RegCloseKey.ADVAPI32(75920F10), ref: 00587314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0058738D
RegCloseKey.ADVAPI32(75920F10), ref: 005873D8

Part of subcall function 0058F1A5: lstrlenA.KERNEL32(000000C8,000000E4,005922F8,000000C8,00587150,?), ref: 0058F1AD

Strings

", xrefs: 00587227
, xrefs: 00587194

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 1391e50a61f47965a6226dd8890b7dc41e1a87555c9fcac81b5bf4b011665c2a
Instruction ID: 479f842311eb4366dbd4b862dee05c62f2502bd010e79d331c36bb29729262e3
Opcode Fuzzy Hash: 1391e50a61f47965a6226dd8890b7dc41e1a87555c9fcac81b5bf4b011665c2a
Instruction Fuzzy Hash: E6B1657290420EAEDF15BFA4DC49AEE7FB8BF58300F200466F915F6090EB719A44DB65

Function 0058AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0058AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0058ADA6

Part of subcall function 0058AD08: gethostname.WS2_32(?,00000080), ref: 0058AD1C
Part of subcall function 0058AD08: lstrlenA.KERNEL32(00000000), ref: 0058AD60
Part of subcall function 0058AD08: lstrlenA.KERNEL32(00000000), ref: 0058AD69
Part of subcall function 0058AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0058AD7F

Part of subcall function 005830B5: gethostname.WS2_32(?,00000080), ref: 005830D8
Part of subcall function 005830B5: gethostbyname.WS2_32(?), ref: 005830E2

wsprintfA.USER32 ref: 0058AEA5

Part of subcall function 0058A7A3: inet_ntoa.WS2_32(?), ref: 0058A7A9

wsprintfA.USER32 ref: 0058AE4F
wsprintfA.USER32 ref: 0058AE5E

Part of subcall function 0058EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0058EF92
Part of subcall function 0058EF7C: lstrlenA.KERNEL32(?), ref: 0058EF99
Part of subcall function 0058EF7C: lstrlenA.KERNEL32(00000000), ref: 0058EFA0

Strings

127.0.0.1, xrefs: 0058ADEB
%OUTLOOK_HST, xrefs: 0058AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0058AE49
%s%d, xrefs: 0058AE58
%OUTLOOK_MID, xrefs: 0058AEAE
%OUTLOOK_BND_, xrefs: 0058AE0F, 0058AE14, 0058AE57, 0058AE76
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0058AE9F

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 02a85955d71b407740b450cf3d5d7bd6c64725403022cecdfa34a03b5822c9fe
Instruction ID: 0d10eaa15e2ae3bbce8702c0774d1215092f7c6183bc77deb9acbf17f042c5b8
Opcode Fuzzy Hash: 02a85955d71b407740b450cf3d5d7bd6c64725403022cecdfa34a03b5822c9fe
Instruction Fuzzy Hash: 13410EB290024DAFDF25BFA0DC4AEEE3FADFB48300F14481ABD15A2191E671D9549B51

Function 00582DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00582F0F,?,005820FF,00592000), ref: 00582E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00582F0F,?,005820FF,00592000), ref: 00582E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00582E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00582F0F,?,005820FF,00592000), ref: 00582E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00582F0F,?,005820FF,00592000), ref: 00582E4F
htons.WS2_32(00000035), ref: 00582E88
inet_addr.WS2_32(?), ref: 00582E93
gethostbyname.WS2_32(?), ref: 00582EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00582F0F,?,005820FF,00592000), ref: 00582EE3
HeapFree.KERNEL32(00000000,?,00000000,00582F0F,?,005820FF,00592000), ref: 00582EE6

Strings

iphlpapi.dll, xrefs: 00582DFB, 00582E00, 00582E10
GetNetworkParams, xrefs: 00582E28

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: d9c7bfcae719d037a8c456171df2c77e5f8ed8c45256260c6ecb78f340eb3425
Instruction ID: 922341dc86f8fee69e06b6784460e9446518025c1c33af9fac31699d24d2f1e5
Opcode Fuzzy Hash: d9c7bfcae719d037a8c456171df2c77e5f8ed8c45256260c6ecb78f340eb3425
Instruction Fuzzy Hash: EE318D32A0020AAFDF10ABA89C48A7E7FBCBF14361F150516ED14F72D0DB30D941AB58

Function 00589326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00589DD7,?,00000022,?,?,00000000,00000001), ref: 00589340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00589DD7,?,00000022,?,?,00000000,00000001), ref: 0058936E
GetModuleFileNameA.KERNEL32(00000000,?,00589DD7,?,00000022,?,?,00000000,00000001), ref: 00589375
wsprintfA.USER32 ref: 005893CE
wsprintfA.USER32 ref: 0058940C
wsprintfA.USER32 ref: 0058948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 005894F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00589526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00589571

Strings

runas, xrefs: 00589674

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 00c52bfc8d07393e2ee36d5c073c120c4b1bc342ba8625653e85aa9147598510
Instruction ID: dda31c8ea1ddfcd8f85cd4c86518c0433070af75a94b5544b158b9adadf57d30
Opcode Fuzzy Hash: 00c52bfc8d07393e2ee36d5c073c120c4b1bc342ba8625653e85aa9147598510
Instruction Fuzzy Hash: F7A171B2940209AFEF21AFA1CC49FEE3FACFB54740F140416FE05A6192E7759944DBA1

Function 0058B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0058B467

Part of subcall function 0058EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0058EF92
Part of subcall function 0058EF7C: lstrlenA.KERNEL32(?), ref: 0058EF99
Part of subcall function 0058EF7C: lstrlenA.KERNEL32(00000000), ref: 0058EFA0

Strings

%TO_HASH, xrefs: 0058B4B0
%DATE, xrefs: 0058B4D2
%TO_EMAIL, xrefs: 0058B473
%s@%s, xrefs: 0058B461
%P5DATE, xrefs: 0058B4F2
%TO_USER, xrefs: 0058B488
%FROM_EMAIL, xrefs: 0058B3E9
%TO_DOMAIN, xrefs: 0058B44B
%FROM_DOMAIN, xrefs: 0058B41E
%M5DATE, xrefs: 0058B50F
%FROM_USER, xrefs: 0058B431

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 550da56052a332197d61d973ae641d01593661ea6dde2b7ac54ae43945a6e2c9
Instruction ID: a5fd2bece3a14e6443a8deb4a92119614e483fbda733bd03286e83eaadd342bc
Opcode Fuzzy Hash: 550da56052a332197d61d973ae641d01593661ea6dde2b7ac54ae43945a6e2c9
Instruction Fuzzy Hash: 8C413DB254021A7EDF01BAA4CCC6CBFBE7CFE89748B140515FE04B2182DB74AE1587A1

Function 00582011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00582078
GetTickCount.KERNEL32 ref: 005820D4
GetTickCount.KERNEL32 ref: 005820DB
GetTickCount.KERNEL32 ref: 0058212B
GetTickCount.KERNEL32 ref: 00582132
GetTickCount.KERNEL32 ref: 00582142

Part of subcall function 0058F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0058E342,00000000,7508EA50,80000001,00000000,0058E513,?,00000000,00000000,?,000000E4), ref: 0058F089
Part of subcall function 0058F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0058E342,00000000,7508EA50,80000001,00000000,0058E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0058F093

Part of subcall function 0058E854: lstrcpyA.KERNEL32(00000001,?,?,0058D8DF,00000001,localcfg,except_info,00100000,00590264), ref: 0058E88B
Part of subcall function 0058E854: lstrlenA.KERNEL32(00000001,?,0058D8DF,00000001,localcfg,except_info,00100000,00590264), ref: 0058E899

Part of subcall function 00581C5F: wsprintfA.USER32 ref: 00581CE1

Strings

net_type, xrefs: 005821DF
localcfg, xrefs: 00582070, 00582160, 00582186, 00582194, 005821E4
rbl_bl, xrefs: 00582181
rbl_ip, xrefs: 0058218F

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 404083959c85139f3fbd42d7225cd49592e306704fde37444b0a146232a7aa52
Instruction ID: 47d0f3a502894e2279d3771d85feafe4a07d8c57dcb838b89f86806a69e6ed4e
Opcode Fuzzy Hash: 404083959c85139f3fbd42d7225cd49592e306704fde37444b0a146232a7aa52
Instruction Fuzzy Hash: 3C512674905346AEEB28FF34ED4EB563FD4BB64314F11042BEA05A61E1DBB4988CEB11

Function 0058C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0058A4C7: GetTickCount.KERNEL32 ref: 0058A4D1
Part of subcall function 0058A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0058A4FA

GetTickCount.KERNEL32 ref: 0058C31F
GetTickCount.KERNEL32 ref: 0058C32B
GetTickCount.KERNEL32 ref: 0058C363
GetTickCount.KERNEL32 ref: 0058C378
GetTickCount.KERNEL32 ref: 0058C44D
InterlockedIncrement.KERNEL32(0058C4E4), ref: 0058C4AE
CreateThread.KERNEL32(00000000,00000000,0058B535,00000000,?,0058C4E0), ref: 0058C4C1
CloseHandle.KERNEL32(00000000,?,0058C4E0,00593588,00588810), ref: 0058C4CC

Strings

localcfg, xrefs: 0058C2DD

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 8bc622da80b490ba786fcb44202681e06fa404c70ba1aaef715262113e20872c
Instruction ID: 97891160370a199d5e581f3bc1fa0a84a983d5dbd71871dea645b45ff048eb0a
Opcode Fuzzy Hash: 8bc622da80b490ba786fcb44202681e06fa404c70ba1aaef715262113e20872c
Instruction Fuzzy Hash: B5515EB1500B418FDB24AF69C5D552ABFE9FB48300B509D3ED98BD7AA0DB74F8458B20

Function 0058BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0058BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0058BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0058BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0058BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0058BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0058BF94

Strings

smtp_herr, xrefs: 0058BE46, 0058BF62
smtp_ban, xrefs: 0058BE55, 0058BF77
smtp_retr, xrefs: 0058BE61, 0058BF8C

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: aa671871660117ce68c784f0eb4c1b095526a378c90ab4636c058e2d63d7d965
Instruction ID: 86473c76f3e1bba70ef8501b2d155f0a5d5c9c22e8d734e88bbe89c2b00be43d
Opcode Fuzzy Hash: aa671871660117ce68c784f0eb4c1b095526a378c90ab4636c058e2d63d7d965
Instruction Fuzzy Hash: 87517A71A0021AEFEF11AB64CC85AAABFADBF44344F045465EE45BB251D730ED458F90

Function 00586A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00589A60,?,?,00589E9D), ref: 00586A7D
GetDiskFreeSpaceA.KERNEL32(00589E9D,00589A60,?,?,?,005922F8,?,?,?,00589A60,?,?,00589E9D), ref: 00586ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00589A60,?,?,00589E9D), ref: 00586B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00589A60,?,?,00589E9D), ref: 00586B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00589A60,?,?,00589E9D), ref: 00586B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00589A60,?,?,00589E9D), ref: 00586B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00589A60,?,?,00589E9D), ref: 00586B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00589A60,?,?,00589E9D), ref: 00586B80
GetLastError.KERNEL32(?,?,?,00589A60,?,?,00589E9D,?,?,?,?,?,00589E9D,?,00000022,?), ref: 00586B96

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 02d6e1065936b2608d10ab96a197519942a0b8c56fd75817e675a799eef356fb
Instruction ID: 8486b0a6dedbd9e4ac7f84e34f73afccdab1783e0dbb7cbcc894e1ee5bcc9cb1
Opcode Fuzzy Hash: 02d6e1065936b2608d10ab96a197519942a0b8c56fd75817e675a799eef356fb
Instruction Fuzzy Hash: FC31DFB2900149BFCB01AFA48C49A9E7FB9FB94314F154466EA51F3261D6308949EB61

Function 00586F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0058D7C3), ref: 00586F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0058D7C3), ref: 00586FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00586FE8
LocalFree.KERNEL32(00000120), ref: 0058701F
wsprintfA.USER32 ref: 00587036

Strings

/%d, xrefs: 00587030
|, xrefs: 00586FB3

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 06c42d0b892617f50f2ccd297672de3892fbf12a1038d2013a1cd71c65604e07
Instruction ID: 7fda37788c16446d3a160edba88621aeba8d5f86c07d0feb99746b1131e8e20c
Opcode Fuzzy Hash: 06c42d0b892617f50f2ccd297672de3892fbf12a1038d2013a1cd71c65604e07
Instruction Fuzzy Hash: 07310972904109AFDB01EFA8DC49ADA7FBCFF04354F148466F959EB141EA35DA088B94

Function 00586CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,005922F8,000000E4,00586DDC,000000C8), ref: 00586CE7
GetProcAddress.KERNEL32(00000000), ref: 00586CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00586D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00586D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00586CDD
kernel32, xrefs: 00586CE2
C:\Windows\SysWOW64\, xrefs: 00586CC9, 00586CD1, 00586CFE, 00586D05, 00586D13, 00586D1E, 00586D2A, 00586D42, 00586D5F, 00586D85

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 3e0c0f6df8e374853d603ad65f17263fcf35bffec466a4d828886019e756b253
Instruction ID: 20281cc739d2c0c4f640394f5e80df93a0415dac9d11723a567c1cde0e75c7c5
Opcode Fuzzy Hash: 3e0c0f6df8e374853d603ad65f17263fcf35bffec466a4d828886019e756b253
Instruction Fuzzy Hash: 7221F3617862457EFB2277219CCEF772E9CAB62740F0D0445FD04BA1D1CB958849D3E6

Function 0058977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00589947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,005922F8), ref: 005897B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,005922F8), ref: 005897EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,005922F8), ref: 005897F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,005922F8), ref: 00589831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,005922F8), ref: 0058984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,005922F8), ref: 0058985B

Strings

D, xrefs: 005897A9

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 817a5e33f359481e819e265d4e35db13a45351d38b72c77169792bee0bd7cb7b
Instruction ID: 797188381c998a87cc4c0dc519e57a24a41638df8dbc6265b30887a70454f660
Opcode Fuzzy Hash: 817a5e33f359481e819e265d4e35db13a45351d38b72c77169792bee0bd7cb7b
Instruction Fuzzy Hash: 2E21EA71901219ABDB21AFA1DC49EEF7FBCFF09754F440461BA19F1190EB709A44DBA0

Function 0058E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058DD05: GetTickCount.KERNEL32 ref: 0058DD0F
Part of subcall function 0058DD05: InterlockedExchange.KERNEL32(005936B4,00000001), ref: 0058DD44
Part of subcall function 0058DD05: GetCurrentThreadId.KERNEL32 ref: 0058DD53

Part of subcall function 0058DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0058DDB5

lstrcpynA.KERNEL32(?,00581E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0058EAAA,?,?), ref: 0058E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0058EAAA,?,?,00000001,?,00581E84,?), ref: 0058E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0058EAAA,?,?,00000001,?,00581E84,?,0000000A), ref: 0058E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0058EAAA,?,?,00000001,?,00581E84,?), ref: 0058E94F

Strings

flags_upd, xrefs: 0058E8A7
localcfg, xrefs: 0058E8AB

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 9ce001ec6d1a79ae145146ebf108fea99df14da154d6fb23b56734258e90859d
Instruction ID: a854e1771fd1a42c0ca285dd3241f0634fcf48e21b99736dddfcfca687e3eafc
Opcode Fuzzy Hash: 9ce001ec6d1a79ae145146ebf108fea99df14da154d6fb23b56734258e90859d
Instruction Fuzzy Hash: 4C51207290020AAFCF11EFA8CD89DAEBBF9FF44304F14456AE805B7251D775EA149B60

Function 00586BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00586BB2

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: b032bb4e97f39ca72972c9906ef33d60368b5c84d9adf9ad03698b315619aa15
Instruction ID: 12c8daea056196986fb341e0a13e32cd8ed8486905098459be465acaa6a4e9f9
Opcode Fuzzy Hash: b032bb4e97f39ca72972c9906ef33d60368b5c84d9adf9ad03698b315619aa15
Instruction Fuzzy Hash: F0218C76105116FFDB11ABA0ED8EEAF3EACFB44365B214816F942F1090EA319E04A774

Function 00589064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,005922F8), ref: 0058907B
wsprintfA.USER32 ref: 005890E9
CreateFileA.KERNEL32(005922F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0058910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00589122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0058912D
CloseHandle.KERNEL32(00000000), ref: 00589134

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 1b9fde78902aa13736f894aa8007790280a78a4b49ad4ecafd151559407fb37f
Instruction ID: a738861740f94c023ab5ee22cd81e25c337bfb6171f61680b1f03aa5a790fcc9
Opcode Fuzzy Hash: 1b9fde78902aa13736f894aa8007790280a78a4b49ad4ecafd151559407fb37f
Instruction Fuzzy Hash: 361160B6A401157EEB247762DC0FEAF3A7EEFD4B00F008465BB0AB5091EA704E0597A4

Function 0058DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0058DD0F
GetCurrentThreadId.KERNEL32 ref: 0058DD20
GetTickCount.KERNEL32 ref: 0058DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0058E538,?,75920F10,?,00000000,?,0058A445), ref: 0058DD3B
InterlockedExchange.KERNEL32(005936B4,00000001), ref: 0058DD44
GetCurrentThreadId.KERNEL32 ref: 0058DD53

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 3341d9d940a0e40184520be392eecd07e12051e6e0ecd16cec8a8a8add3c1a34
Instruction ID: d239cd33ed94e708f43b261c5686271b9352b27746e2662e1d2647c366efaf60
Opcode Fuzzy Hash: 3341d9d940a0e40184520be392eecd07e12051e6e0ecd16cec8a8a8add3c1a34
Instruction Fuzzy Hash: E7F03A7210A204EFDB807B65EC88B297BBDB764352F520817E909D22E1C620554DAB72

Function 0058AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0058AD1C
lstrlenA.KERNEL32(00000000), ref: 0058AD60
lstrlenA.KERNEL32(00000000), ref: 0058AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0058AD7F

Strings

LocalHost, xrefs: 0058AD79

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: d1334e7e346efccfb67e56f11ec45cb030e63fe983f017198343dae4e9b67a9a
Instruction ID: f6d23e2f0ab6bc1a61baded4a398bbfb9a0efff2e5028dd009830524873fb863
Opcode Fuzzy Hash: d1334e7e346efccfb67e56f11ec45cb030e63fe983f017198343dae4e9b67a9a
Instruction Fuzzy Hash: 7801492084718A5DFF312638C849BA83F657B96706F501057DCC0FB552E75488478393

Function 00584280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,005898FD,00000001,00000100,005922F8,0058A3C7), ref: 00584290
CloseHandle.KERNEL32(0058A3C7), ref: 005843AB
CloseHandle.KERNEL32(00000001), ref: 005843AE

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 8e663a4919ce21789db47b93a822a11e95de8e9a393db1a0baf550b1586e138a
Instruction ID: 8ed10c0d01bd3a70c843a1ceabe46b79eab774362ee8db5b925d5696853f6cf8
Opcode Fuzzy Hash: 8e663a4919ce21789db47b93a822a11e95de8e9a393db1a0baf550b1586e138a
Instruction Fuzzy Hash: 14415271D0020ABADB11BBA1CD4AFAFBFB8FF50324F104555FA15B6191DB349A41DBA0

Function 00586069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,005864CF,00000000), ref: 0058609C
LoadLibraryA.KERNEL32(?,?,005864CF,00000000), ref: 005860C3
GetProcAddress.KERNEL32(?,00000014), ref: 0058614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0058619E

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 7417b5062ec8b780af2576205f51cb3f6dd7606426fb71b98cbec1f5e51fe893
Instruction ID: 2c23cd3d660cae4e92103472210dded9d80780ad075a09ff250d2f7d6265e6d9
Opcode Fuzzy Hash: 7417b5062ec8b780af2576205f51cb3f6dd7606426fb71b98cbec1f5e51fe893
Instruction Fuzzy Hash: C9417E71A0020AEFEB14EF54C889B69BBB5FF54354F248469EC15E7292D730ED44DB90

Function 00582923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b8ed515d95014c9f12c195973792b191e6655b7135165835591cc256dc8ec6d
Instruction ID: 6c7acacdf30916735746126e511b2849d38917e08f4b1ef8a700bc547f0ad9c7
Opcode Fuzzy Hash: 6b8ed515d95014c9f12c195973792b191e6655b7135165835591cc256dc8ec6d
Instruction Fuzzy Hash: A831A271900309ABCB21AFA5CC86ABEBFF4FF88701F10445AF904F6241E374D6419B54

Function 005826FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0058272E
htons.WS2_32(00000001), ref: 00582752
htons.WS2_32(0000000F), ref: 005827D5
htons.WS2_32(00000001), ref: 005827E3
sendto.WS2_32(?,00592BF8,00000009,00000000,00000010,00000010), ref: 00582802

Part of subcall function 0058EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0058EBFE,7FFF0001,?,0058DB55,7FFF0001), ref: 0058EBD3
Part of subcall function 0058EBCC: RtlAllocateHeap.NTDLL(00000000,?,0058DB55,7FFF0001), ref: 0058EBDA

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6b4ac34e46d69064742db03da368e433e806df5773486b07820e3e258c1c9f74
Instruction ID: a0e03ce6bb1e1962ea972e9dfa4345a0d6219e2a288a0babf4e75a31aee6b6c4
Opcode Fuzzy Hash: 6b4ac34e46d69064742db03da368e433e806df5773486b07820e3e258c1c9f74
Instruction Fuzzy Hash: D7315834248382AFD710AF75DC80AA17FA1FF29314F1A405EEC55DB362D232D846EB40

Function 00589145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,005922F8), ref: 0058915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00589166
CharToOemA.USER32(?,?), ref: 00589174
wsprintfA.USER32 ref: 005891A9

Part of subcall function 00589064: GetTempPathA.KERNEL32(00000400,?,00000000,005922F8), ref: 0058907B
Part of subcall function 00589064: wsprintfA.USER32 ref: 005890E9
Part of subcall function 00589064: CreateFileA.KERNEL32(005922F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0058910E
Part of subcall function 00589064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00589122
Part of subcall function 00589064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0058912D
Part of subcall function 00589064: CloseHandle.KERNEL32(00000000), ref: 00589134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 005891E1

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 91da892636d35ff38e1f150f3662612a038ac529670e557179a7a8debd4df691
Instruction ID: 7ea5455e05a7b2fddbd0b01b9bd2270055816c6270c4dec458befefc8539a1d0
Opcode Fuzzy Hash: 91da892636d35ff38e1f150f3662612a038ac529670e557179a7a8debd4df691
Instruction Fuzzy Hash: EC0140F79401597BDB20A7619D4DEEF7A7CEB95701F000492BB49E2080D6709689DF70

Function 00582419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00582491,?,?,?,0058E844,-00000030,?,?,?,00000001), ref: 00582429
lstrlenA.KERNEL32(?,?,00582491,?,?,?,0058E844,-00000030,?,?,?,00000001,00581E3D,00000001,localcfg,lid_file_upd), ref: 0058243E
lstrcmpiA.KERNEL32(?,?), ref: 00582452
lstrlenA.KERNEL32(?,?,00582491,?,?,?,0058E844,-00000030,?,?,?,00000001,00581E3D,00000001,localcfg,lid_file_upd), ref: 00582467

Strings

localcfg, xrefs: 0058241F

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 05d59d671057383c5fe8364570ded2ea5f8ab37adda341bc29f5a88abc438164
Instruction ID: b4763c10ac74ea25fac23482522455bffd9e2aeaf56f79cff36af7c6a7f468ea
Opcode Fuzzy Hash: 05d59d671057383c5fe8364570ded2ea5f8ab37adda341bc29f5a88abc438164
Instruction Fuzzy Hash: 54011632600218AF8F11EF69CC848DE7FA9FF44394B41C426EC59A7221E330EA449BA0

Function 00586EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00586F0F
CheckTokenMembership.ADVAPI32(00000000,?,*pX), ref: 00586F24
FreeSid.ADVAPI32(?), ref: 00586F3E

Strings

*pX, xrefs: 00586F1C, 00586F1F

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *pX
API String ID: 3429775523-2148842004
Opcode ID: 4881acc55ebea0d4f38da4ad6dd78fe5aab788cda045f44b9808cccd0cb2e288
Instruction ID: bf60d1d7a0064ee5dcd7cf18446fb517f99209cc8872dba001024e59d94828a8
Opcode Fuzzy Hash: 4881acc55ebea0d4f38da4ad6dd78fe5aab788cda045f44b9808cccd0cb2e288
Instruction Fuzzy Hash: 7A012171900208BFDB10EFE4EDCDAAEBBB8FB14340F50586AE605E2191E7749948DB50

Function 00581C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00581CE1
wsprintfA.USER32 ref: 00581D6B

Strings

localcfg, xrefs: 00581C70
%u.%u.%u.%u.%s, xrefs: 00581CDB, 00581D65

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 3815ade6c678e87d29aea3915de10795e644cc3b414b66c6fae1c24f966c2de3
Instruction ID: b4971b48a1925d251b48dccaca37b61c4f1780e84641dcb2a1a074b2f7f8dc0d
Opcode Fuzzy Hash: 3815ade6c678e87d29aea3915de10795e644cc3b414b66c6fae1c24f966c2de3
Instruction Fuzzy Hash: 634179729042999FDB21AF798845BEE3FECAF49310F240456FDA4E3152D634DA05CBA4

Function 0058E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058DD05: GetTickCount.KERNEL32 ref: 0058DD0F
Part of subcall function 0058DD05: InterlockedExchange.KERNEL32(005936B4,00000001), ref: 0058DD44
Part of subcall function 0058DD05: GetCurrentThreadId.KERNEL32 ref: 0058DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00585EC1), ref: 0058E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00585EC1), ref: 0058E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,75920F10,00000000,?,00585EC1), ref: 0058E722

Strings

89ABCDEF, xrefs: 0058E721

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: ba9ba0bd13f64bbbf955937741172d7d9a857fe90e79aea4a58b190c6f703fd3
Instruction ID: 109382ba19e10e92be05a398aa9774a3a3589488974f1a92780cbbcfc06506b7
Opcode Fuzzy Hash: ba9ba0bd13f64bbbf955937741172d7d9a857fe90e79aea4a58b190c6f703fd3
Instruction Fuzzy Hash: 2931AE31600742EBDF31AF66E88A7667FF4FB21714F10482AE855A7591E770EC84CB91

Function 0058E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0058E2A3,00000000,00000000,00000000,00020106,00000000,0058E2A3,00000000,000000E4), ref: 0058E0B2
RegSetValueExA.ADVAPI32(0058E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,005922F8), ref: 0058E127
RegDeleteValueA.ADVAPI32(0058E2A3,?,?,?,?,?,000000C8,005922F8), ref: 0058E158
RegCloseKey.ADVAPI32(0058E2A3,?,?,?,?,000000C8,005922F8,?,?,?,?,?,?,?,?,0058E2A3), ref: 0058E161

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 9f43d1895c7e8e49df73bf3c525528f3bd75261aa3ae7265d93bba60e1a1ec81
Instruction ID: 7ca3b6f40124935734289f0850a53d58ec32c59f42c0bc622bd4e97b0c00cfb5
Opcode Fuzzy Hash: 9f43d1895c7e8e49df73bf3c525528f3bd75261aa3ae7265d93bba60e1a1ec81
Instruction Fuzzy Hash: B7214A72A0021ABBDF21AEA4DC8EE9E7FB9EF09750F004061FD04A6151E6718A14DBA0

Function 00583F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0058A3C7,00000000,00000000,000007D0,00000001), ref: 00583F44
GetLastError.KERNEL32 ref: 00583F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00583F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00583F72

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: d21991177029c399b3d2b8021275696ab5592b009a3a0fb8940bb2fca6691c30
Instruction ID: d624ca7e7ac0ad00abd4afdc45f23b853dd35bf7342907deebc47493c730e8c0
Opcode Fuzzy Hash: d21991177029c399b3d2b8021275696ab5592b009a3a0fb8940bb2fca6691c30
Instruction Fuzzy Hash: 27011372910119AFDB01EF90DD89BEE3BBCFB14765F504426FA01E2090D7389A549BA2

Function 00583F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0058A3C7,00000000,00000000,000007D0,00000001), ref: 00583FB8
GetLastError.KERNEL32 ref: 00583FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00583FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00583FE6

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 143ec55763df65574b2e4c38084b8a6add5195312defc412ebfde8fdc90f019e
Instruction ID: 1e24af0eaaf1f14eae8e32c82e581ee4e163c7076320dcf7abf02c088f85d9c1
Opcode Fuzzy Hash: 143ec55763df65574b2e4c38084b8a6add5195312defc412ebfde8fdc90f019e
Instruction Fuzzy Hash: 3A01177291010AAFDF01EF90DD49BEE3BBCFB14755F404412FE02E2050DB349A149BA1

Function 0058A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0058A4D1
GetTickCount.KERNEL32 ref: 0058A4E4
Sleep.KERNEL32(00000000,?,0058C2E9,0058C4E0,00000000,localcfg,?,0058C4E0,00593588,00588810), ref: 0058A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0058A4FA

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 9b4bc59cdc4e81de29b5722bb297efedeabe73cce6198cca60468a244ce331fb
Instruction ID: 35b78d7372b3bf73720778e6ee65f245a67f5b353360daa2c3e61f8afcc96c69
Opcode Fuzzy Hash: 9b4bc59cdc4e81de29b5722bb297efedeabe73cce6198cca60468a244ce331fb
Instruction Fuzzy Hash: 1DE026332012145BDE0037A5AC88F6A3B88BB59761F520423FE04E3181C65AA84552B3

Function 00584E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00584E9E
GetTickCount.KERNEL32 ref: 00584EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00584EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00584EC3

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: ce6ea6e3e1b6457d2dcd1246f9062e50ac9c8e41623d89c66b691c48607538ad
Instruction ID: 31816c615e92a82c30745d30cf8128938994f5740e80e69fe8703ee8b8630fd7
Opcode Fuzzy Hash: ce6ea6e3e1b6457d2dcd1246f9062e50ac9c8e41623d89c66b691c48607538ad
Instruction Fuzzy Hash: 68E086323012155BDA1037B9AC88F566A4DBB65361F420932EE09E21C0D55698565AB2

Function 00584BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00584BDD
GetTickCount.KERNEL32 ref: 00584BEC
Sleep.KERNEL32(00000000,?,?,?,02C1B1A4,005850F2), ref: 00584BF9
InterlockedExchange.KERNEL32(02C1B198,00000001), ref: 00584C02

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: e6790b64c17f6cf3ea7d5e2bcbe68a4c7932bd0b28c1956b98515fdee0f2547e
Instruction ID: 815bcdab91302747cf0324a065ce6bb653f4f020dec8ba6866d5480b5290bbc5
Opcode Fuzzy Hash: e6790b64c17f6cf3ea7d5e2bcbe68a4c7932bd0b28c1956b98515fdee0f2547e
Instruction Fuzzy Hash: 4BE086322412155BCA1037A65C88F667B9CAB65362F470863FE08E2190C556D8455AB1

Function 005830FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00583103
GetTickCount.KERNEL32 ref: 0058310F
Sleep.KERNEL32(00000000), ref: 0058311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00583128

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: e3801b31ed2d7e18ae7222f15feeaa4832a4727d973fed973e74718878171cec
Instruction ID: f347e40ea8e750aded507908fc42ea070c85173012e208e55f1db5fad4083c8c
Opcode Fuzzy Hash: e3801b31ed2d7e18ae7222f15feeaa4832a4727d973fed973e74718878171cec
Instruction Fuzzy Hash: 1BE0C231200215AFDF007B75AD4CB496E5EEFA4F61F021832FA05E20E0C5504D04DA71

Function 00586987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00589A60,?,?,00000000,00000000,00589A60,?,00000000), ref: 005869F9
WriteFile.KERNEL32(00589A60,?,00589A60,00000000,00000000), ref: 00586A27

Strings

,kX, xrefs: 005869A7, 005869D5

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,kX
API String ID: 3934441357-766446908
Opcode ID: 89f6dd7bf88ec9d0993cf4bc3a714d28e869839243ab049c6530bb3f0824a856
Instruction ID: 551325a3a12dc3137fe35f92833f27e0a24946d5c8bc066526dc19d6c365b3d2
Opcode Fuzzy Hash: 89f6dd7bf88ec9d0993cf4bc3a714d28e869839243ab049c6530bb3f0824a856
Instruction Fuzzy Hash: A1311A72A00209EFDB24EF58D984BAA7BF4FB14315F11846AE805F7240D770EE54DB61

Function 00588CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00588D02
GetTickCount.KERNEL32 ref: 00588DA1

Strings

localcfg, xrefs: 00588D19

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 8979ab0e950ed3dec3906cf6327ff1bbbe81d62520f8ace6e79a5af0d4af69bd
Instruction ID: bb625317a0aece82bb9da39e46c9823caafe211c88907e4f96305b73c30f15b6
Opcode Fuzzy Hash: 8979ab0e950ed3dec3906cf6327ff1bbbe81d62520f8ace6e79a5af0d4af69bd
Instruction Fuzzy Hash: 6B21C032A12515AFDB10AB64CC8567ABFB9FF20310BAA059AD801FB192DF24ED44D750

Function 0058BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0058BFD0
wsprintfA.USER32 ref: 0058C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0058C057

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: f859310123432ae3d6d7625cf507408198be198a903e8f1c79c3ec7a573f3759
Instruction ID: 5e1ba422ffc782ea90c085b193e9dc34ca9dcb5387bb180acdee412c688563eb
Opcode Fuzzy Hash: f859310123432ae3d6d7625cf507408198be198a903e8f1c79c3ec7a573f3759
Instruction Fuzzy Hash: F7119772100100FFDB429BA9CD48E567FA6FF88318B34959CF6188E166D633D863EB50

Function 005838F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 005830FA: GetTickCount.KERNEL32 ref: 00583103
Part of subcall function 005830FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00583128

GetCurrentThreadId.KERNEL32 ref: 00583929
GetCurrentThreadId.KERNEL32 ref: 00583939

Strings

%FROM_EMAIL, xrefs: 00583913

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 6ad77a60f01890b875d1d41492954f3dc4d232c97a6cd9a9ed2180f922f463ea
Instruction ID: 942b9e91a825bb50f0535bb2116cc5c14f91ddd91f34dce6b4b57007254baf30
Opcode Fuzzy Hash: 6ad77a60f01890b875d1d41492954f3dc4d232c97a6cd9a9ed2180f922f463ea
Instruction Fuzzy Hash: 82113A71900215EFDB20EF19D485A5CFBF4FB44B15F11855EE844A7291C7B0AB84DFA1

Function 0058AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0058BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0058ABB9
InterlockedIncrement.KERNEL32(00593640), ref: 0058ABE1

Strings

%FROM_EMAIL, xrefs: 0058AB8C

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 5365ef512a4cf386cd6ae4bf41b7fb28eded17692f6d7dd433ba83c61a505c58
Instruction ID: 448eb612cfbd5bd5826d80624b811563f165f13a484ae6dce9a978b6847103c8
Opcode Fuzzy Hash: 5365ef512a4cf386cd6ae4bf41b7fb28eded17692f6d7dd433ba83c61a505c58
Instruction Fuzzy Hash: 4A01DE315082C4AFEB11DF18C885E967FA6BF15310F150886E9C097243C370EA54CB92

Function 005826B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 005826C3
inet_ntoa.WS2_32(?), ref: 005826E4

Strings

localcfg, xrefs: 005826CD, 005826D2, 005826DE

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 733d67618a5d9cc1b5b6701a143e44742264012678c59314441e38710e9c3057
Instruction ID: c628adac2cdd6a99af951da8a049d16bfac41526c08247e47e838d957d2334d7
Opcode Fuzzy Hash: 733d67618a5d9cc1b5b6701a143e44742264012678c59314441e38710e9c3057
Instruction Fuzzy Hash: 6AF012761482096FEF017FA5EC0AA9A3F9CEF05750F244426FE08EA090EB71D9409798

Function 0058EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0058EB54,_alldiv,0058F0B7,80000001,00000000,00989680,00000000,?,?,?,0058E342,00000000,7508EA50,80000001,00000000), ref: 0058EAF2
GetProcAddress.KERNEL32(76E80000,00000000), ref: 0058EB07

Strings

ntdll.dll, xrefs: 0058EAED

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 8e6e06c7558750a1ad83c595d3406a65834ef7cbde7adb9250f2cef5361a6fed
Instruction ID: ba2d27b83aff272e1f946c75a0baa71f167c3c772065968d448fa8cf0a6903da
Opcode Fuzzy Hash: 8e6e06c7558750a1ad83c595d3406a65834ef7cbde7adb9250f2cef5361a6fed
Instruction Fuzzy Hash: 05D0C935600302ABCF125FA5EE0F90A7AA8BB70742B814416A806D1260E730D94CFB00

Function 00582F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00582D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00582F01,?,005820FF,00592000), ref: 00582D3A
Part of subcall function 00582D21: LoadLibraryA.KERNEL32(?), ref: 00582D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00582F73
HeapFree.KERNEL32(00000000), ref: 00582F7A

Memory Dump Source

Source File: 00000012.00000002.3312549089.0000000000580000.00000040.00000400.00020000.00000000.sdmp, Offset: 00580000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_580000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 16ae6e11ea641eefda1b6fb03ecbb5fd1937459cee1e705a20da0c5ed0a7ab8d
Instruction ID: def97f928de5e8bad377f987667f7f5327d8168d8582f0daa6cacf893c57d474
Opcode Fuzzy Hash: 16ae6e11ea641eefda1b6fb03ecbb5fd1937459cee1e705a20da0c5ed0a7ab8d
Instruction Fuzzy Hash: 30519D7190020AEFDF02AF64D8899B9BBB9FF15304F104569ED96E7211E7329A19CB90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fdnoqmpv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\fzzrueiu.exe

C:\Windows\SysWOW64\miqllcjz\fzzrueiu.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

Windows Analysis Report
fdnoqmpv.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre