Edit tour

Windows Analysis Report
igvdwmhd.exe

Overview

General Information

Sample name:	igvdwmhd.exe
Analysis ID:	1488276
MD5:	c9bc1db6a4cbaea0905f847035b8df57
SHA1:	4c719e43ae5aa3aedc3c495ea87bcf91c9a3f1f1
SHA256:	0af8466115f0b1e17bc2d35d10acbbec1a2162bbf497e1acacf2bd17b926f068
Tags:	exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Use Short Name Path in Command Line

Sigma detected: Windows Defender Exclusions Added - Registry

Uses SMTP (mail sending)

Yara signature match

Classification

Process Tree

System is w10x64

svchost.exe (PID: 7180 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 7556 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 7584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

igvdwmhd.exe (PID: 7348 cmdline: "C:\Users\user\Desktop\igvdwmhd.exe" MD5: C9BC1DB6A4CBAEA0905F847035B8DF57)

cmd.exe (PID: 7536 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ptcoklzf\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7592 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\ybyrikeu.exe" C:\Windows\SysWOW64\ptcoklzf\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7644 cmdline: "C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7700 cmdline: "C:\Windows\System32\sc.exe" description ptcoklzf "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7756 cmdline: "C:\Windows\System32\sc.exe" start ptcoklzf MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7820 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7928 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 1232 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7472 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ybyrikeu.exe (PID: 7800 cmdline: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d"C:\Users\user\Desktop\igvdwmhd.exe" MD5: 4E044BA5CE650DE4D036125F371C831D)

svchost.exe (PID: 7952 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 7992 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 544 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7836 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7904 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7348 -ip 7348 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7968 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7800 -ip 7800 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 1240 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000F.00000002.1368074204.00000000029B2000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5132:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000002.00000002.1351232837.0000000002BB9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x531a:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: igvdwmhd.exe PID: 7348	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: ybyrikeu.exe PID: 7800	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 7952	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
15.2.ybyrikeu.exe.28e0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
15.2.ybyrikeu.exe.28e0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
15.2.ybyrikeu.exe.28e0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
15.2.ybyrikeu.exe.2950000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
15.2.ybyrikeu.exe.2950000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
15.2.ybyrikeu.exe.2950000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
15.2.ybyrikeu.exe.2950000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
15.2.ybyrikeu.exe.2950000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
15.2.ybyrikeu.exe.2950000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
2.3.igvdwmhd.exe.2af0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
2.3.igvdwmhd.exe.2af0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
2.3.igvdwmhd.exe.2af0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
2.2.igvdwmhd.exe.29b0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
2.2.igvdwmhd.exe.29b0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
21.2.svchost.exe.2b80000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
21.2.svchost.exe.2b80000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
21.2.svchost.exe.2b80000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
2.3.igvdwmhd.exe.2af0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
2.3.igvdwmhd.exe.2af0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
15.3.ybyrikeu.exe.2910000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
15.3.ybyrikeu.exe.2910000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
15.2.ybyrikeu.exe.28e0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
15.2.ybyrikeu.exe.28e0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
15.2.ybyrikeu.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
15.2.ybyrikeu.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
15.2.ybyrikeu.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
2.2.igvdwmhd.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
2.2.igvdwmhd.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
2.2.igvdwmhd.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
2.2.igvdwmhd.exe.29b0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
2.2.igvdwmhd.exe.29b0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
2.2.igvdwmhd.exe.29b0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
21.2.svchost.exe.2b80000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
15.2.ybyrikeu.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
15.2.ybyrikeu.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
15.2.ybyrikeu.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
21.2.svchost.exe.2b80000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
21.2.svchost.exe.2b80000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
15.3.ybyrikeu.exe.2910000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
15.3.ybyrikeu.exe.2910000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
15.3.ybyrikeu.exe.2910000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
2.2.igvdwmhd.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
2.2.igvdwmhd.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
2.2.igvdwmhd.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d"C:\Users\user\Desktop\igvdwmhd.exe", ParentImage: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, ParentProcessId: 7800, ParentProcessName: ybyrikeu.exe, ProcessCommandLine: svchost.exe, ProcessId: 7952, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\igvdwmhd.exe", ParentImage: C:\Users\user\Desktop\igvdwmhd.exe, ParentProcessId: 7348, ParentProcessName: igvdwmhd.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7644, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.40.26, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 7952, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d"C:\Users\user\Desktop\igvdwmhd.exe", ParentImage: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, ParentProcessId: 7800, ParentProcessName: ybyrikeu.exe, ProcessCommandLine: svchost.exe, ProcessId: 7952, ProcessName: svchost.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\ybyrikeu.exe" C:\Windows\SysWOW64\ptcoklzf\, CommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\ybyrikeu.exe" C:\Windows\SysWOW64\ptcoklzf\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\igvdwmhd.exe", ParentImage: C:\Users\user\Desktop\igvdwmhd.exe, ParentProcessId: 7348, ParentProcessName: igvdwmhd.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\ybyrikeu.exe" C:\Windows\SysWOW64\ptcoklzf\, ProcessId: 7592, ProcessName: cmd.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 7952, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ptcoklzf

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\igvdwmhd.exe", ParentImage: C:\Users\user\Desktop\igvdwmhd.exe, ParentProcessId: 7348, ParentProcessName: igvdwmhd.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7644, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc, CommandLine: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc, ProcessId: 7180, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: vanaheim.cn:443	Avira URL Cloud: Label: phishing
Source: jotunheim.name:443	Avira URL Cloud: Label: malware

Found malware configuration

Source: 15.3.ybyrikeu.exe.2910000.0.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for submitted file

Source: igvdwmhd.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.3% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ybyrikeu.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: igvdwmhd.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\igvdwmhd.exe	Unpacked PE file: 2.2.igvdwmhd.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Unpacked PE file: 15.2.ybyrikeu.exe.400000.0.unpack

Source: C:\Users\user\Desktop\igvdwmhd.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\ptcoklzf

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 108.177.15.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.40.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.226.112.95 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.110 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.40.26 52.101.40.26
Source: Joe Sandbox View	IP Address: 213.226.112.95 213.226.112.95
Source: Joe Sandbox View	IP Address: 67.195.228.110 67.195.228.110
Source: Joe Sandbox View	IP Address: 94.100.180.31 94.100.180.31

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: RETN-ASEU RETN-ASEU
Source: Joe Sandbox View	ASN Name: YAHOO-GQ1US YAHOO-GQ1US
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU

Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 52.101.40.26:25
Source: global traffic	TCP traffic: 192.168.2.7:49708 -> 67.195.228.110:25
Source: global traffic	TCP traffic: 192.168.2.7:49709 -> 108.177.15.27:25
Source: global traffic	TCP traffic: 192.168.2.7:49712 -> 94.100.180.31:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

2_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 15.2.ybyrikeu.exe.28e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.2950000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.2950000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.igvdwmhd.exe.2af0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.svchost.exe.2b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.igvdwmhd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.igvdwmhd.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.svchost.exe.2b80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.ybyrikeu.exe.2910000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.igvdwmhd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: igvdwmhd.exe PID: 7348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ybyrikeu.exe PID: 7800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7952, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 15.2.ybyrikeu.exe.28e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 15.2.ybyrikeu.exe.28e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 15.2.ybyrikeu.exe.2950000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 15.2.ybyrikeu.exe.2950000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 15.2.ybyrikeu.exe.2950000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 15.2.ybyrikeu.exe.2950000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 2.3.igvdwmhd.exe.2af0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 2.3.igvdwmhd.exe.2af0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 2.2.igvdwmhd.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 2.2.igvdwmhd.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 21.2.svchost.exe.2b80000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 21.2.svchost.exe.2b80000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 2.3.igvdwmhd.exe.2af0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 2.3.igvdwmhd.exe.2af0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 15.3.ybyrikeu.exe.2910000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 15.3.ybyrikeu.exe.2910000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 15.2.ybyrikeu.exe.28e0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 15.2.ybyrikeu.exe.28e0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 15.2.ybyrikeu.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 15.2.ybyrikeu.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 2.2.igvdwmhd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 2.2.igvdwmhd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 2.2.igvdwmhd.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 2.2.igvdwmhd.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 15.2.ybyrikeu.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 15.2.ybyrikeu.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 21.2.svchost.exe.2b80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 21.2.svchost.exe.2b80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 15.3.ybyrikeu.exe.2910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 15.3.ybyrikeu.exe.2910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 2.2.igvdwmhd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 2.2.igvdwmhd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000F.00000002.1368074204.00000000029B2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000002.00000002.1351232837.0000000002BB9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

2_2_00408E26

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

2_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\ptcoklzf\

Jump to behavior

Source: C:\Users\user\Desktop\igvdwmhd.exe	Code function: 2_2_0040C913	2_2_0040C913
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Code function: 15_2_0040C913	15_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 21_2_02B8C913	21_2_02B8C913

Source: C:\Users\user\Desktop\igvdwmhd.exe	Code function: String function: 029B27AB appears 35 times
Source: C:\Users\user\Desktop\igvdwmhd.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\igvdwmhd.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7348 -ip 7348

Source: igvdwmhd.exe, 00000002.00000002.1350362984.000000000282C000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamesOdilesigo: vs igvdwmhd.exe
Source: igvdwmhd.exe, 00000002.00000002.1351269613.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesOdilesigo: vs igvdwmhd.exe
Source: igvdwmhd.exe	Binary or memory string: OriginalFilenamesOdilesigo: vs igvdwmhd.exe

Source: 15.2.ybyrikeu.exe.28e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 15.2.ybyrikeu.exe.28e0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 15.2.ybyrikeu.exe.2950000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 15.2.ybyrikeu.exe.2950000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 15.2.ybyrikeu.exe.2950000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 15.2.ybyrikeu.exe.2950000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 2.3.igvdwmhd.exe.2af0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 2.3.igvdwmhd.exe.2af0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 2.2.igvdwmhd.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 2.2.igvdwmhd.exe.29b0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 21.2.svchost.exe.2b80000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 21.2.svchost.exe.2b80000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 2.3.igvdwmhd.exe.2af0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 2.3.igvdwmhd.exe.2af0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 15.3.ybyrikeu.exe.2910000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 15.3.ybyrikeu.exe.2910000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 15.2.ybyrikeu.exe.28e0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 15.2.ybyrikeu.exe.28e0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 15.2.ybyrikeu.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 15.2.ybyrikeu.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 2.2.igvdwmhd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 2.2.igvdwmhd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 2.2.igvdwmhd.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 2.2.igvdwmhd.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 15.2.ybyrikeu.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 15.2.ybyrikeu.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 21.2.svchost.exe.2b80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 21.2.svchost.exe.2b80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 15.3.ybyrikeu.exe.2910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 15.3.ybyrikeu.exe.2910000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 2.2.igvdwmhd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 2.2.igvdwmhd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000F.00000002.1368074204.00000000029B2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000002.00000002.1351232837.0000000002BB9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: classification engine

Classification label: mal100.troj.evad.winEXE@37/4@10/5

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

2_2_00406A60

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_02BBE348 CreateToolhelp32Snapshot,Module32First,

2_2_02BBE348

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

2_2_00409A6B

Source: C:\Users\user\Desktop\igvdwmhd.exe	Code function: 2_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	2_2_00409A6B
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Code function: 15_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	15_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 21_2_02B89A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	21_2_02B89A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7584:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7968:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7904:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03

Source: C:\Users\user\Desktop\igvdwmhd.exe

File created: C:\Users\user~1\AppData\Local\Temp\ybyrikeu.exe

Jump to behavior

Source: C:\Users\user\Desktop\igvdwmhd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\igvdwmhd.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: igvdwmhd.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\igvdwmhd.exe

File read: C:\Users\user\Desktop\igvdwmhd.exe

Jump to behavior

Source: C:\Users\user\Desktop\igvdwmhd.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_2-14491
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_15-14636

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Users\user\Desktop\igvdwmhd.exe "C:\Users\user\Desktop\igvdwmhd.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ptcoklzf\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\ybyrikeu.exe" C:\Windows\SysWOW64\ptcoklzf\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description ptcoklzf "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start ptcoklzf
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d"C:\Users\user\Desktop\igvdwmhd.exe"
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7348 -ip 7348
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 1232
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7800 -ip 7800
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 544
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ptcoklzf\	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\ybyrikeu.exe" C:\Windows\SysWOW64\ptcoklzf\	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description ptcoklzf "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start ptcoklzf	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7348 -ip 7348	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 1232	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7800 -ip 7800	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 544	Jump to behavior

Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior

Source: C:\Users\user\Desktop\igvdwmhd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: igvdwmhd.exe

Static file information: File size 14508544 > 1048576

Source: C:\Users\user\Desktop\igvdwmhd.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\igvdwmhd.exe	Unpacked PE file: 2.2.igvdwmhd.exe.400000.0.unpack .text:ER;.data:W;.xevaj:R;.zac:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Unpacked PE file: 15.2.ybyrikeu.exe.400000.0.unpack .text:ER;.data:W;.xevaj:R;.zac:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\igvdwmhd.exe	Unpacked PE file: 2.2.igvdwmhd.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Unpacked PE file: 15.2.ybyrikeu.exe.400000.0.unpack

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

2_2_00406069

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe

Source: C:\Users\user\Desktop\igvdwmhd.exe	File created: C:\Users\user\AppData\Local\Temp\ybyrikeu.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe (copy)

Jump to dropped file

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Jump to behavior

Source: C:\Users\user\Desktop\igvdwmhd.exe

2_2_00409A6B

Source: C:\Users\user\Desktop\igvdwmhd.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\igvdwmhd.exe

Jump to behavior

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00401000

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

21_2_02B8199C

Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_15-15060
Source: C:\Users\user\Desktop\igvdwmhd.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_2-15933
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_21-6989

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_21-6131

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_21-7318
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_15-15017
Source: C:\Users\user\Desktop\igvdwmhd.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_2-14924

Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_15-14651
Source: C:\Users\user\Desktop\igvdwmhd.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_2-14506

Source: C:\Users\user\Desktop\igvdwmhd.exe	API coverage: 5.4 %
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	API coverage: 3.9 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 7988	Thread sleep count: 33 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7988	Thread sleep time: -33000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

2_2_00401D96

Source: svchost.exe, 00000015.00000002.2523329859.0000000003000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: svchost.exe, 00000004.00000002.2523386989.000002104C631000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\igvdwmhd.exe	API call chain: ExitProcess graph end node			graph_2-14936
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	API call chain: ExitProcess graph end node			graph_15-15020

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_21-7483
Source: C:\Users\user\Desktop\igvdwmhd.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_2-15994

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

2_2_00406069

Source: C:\Users\user\Desktop\igvdwmhd.exe	Code function: 2_2_029B0D90 mov eax, dword ptr fs:[00000030h]	2_2_029B0D90
Source: C:\Users\user\Desktop\igvdwmhd.exe	Code function: 2_2_029B092B mov eax, dword ptr fs:[00000030h]	2_2_029B092B
Source: C:\Users\user\Desktop\igvdwmhd.exe	Code function: 2_2_02BBDC25 push dword ptr fs:[00000030h]	2_2_02BBDC25
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Code function: 15_2_028E0D90 mov eax, dword ptr fs:[00000030h]	15_2_028E0D90
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Code function: 15_2_028E092B mov eax, dword ptr fs:[00000030h]	15_2_028E092B
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Code function: 15_2_029B6A3D push dword ptr fs:[00000030h]	15_2_029B6A3D

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

2_2_0040EBCC

Source: C:\Users\user\Desktop\igvdwmhd.exe	Code function: 2_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	2_2_00409A6B
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Code function: 15_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	15_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 21_2_02B89A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	21_2_02B89A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 108.177.15.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.40.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.226.112.95 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.110 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2B80000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B80000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B80000			Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2DF9008			Jump to behavior

Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ptcoklzf\	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\ybyrikeu.exe" C:\Windows\SysWOW64\ptcoklzf\	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description ptcoklzf "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start ptcoklzf	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7348 -ip 7348	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 1232	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7800 -ip 7800	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 544	Jump to behavior

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

2_2_00407809

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

2_2_00406EDD

Source: C:\Users\user\Desktop\igvdwmhd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\igvdwmhd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

2_2_0040405E

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

2_2_0040EC54

Source: C:\Users\user\Desktop\igvdwmhd.exe

2_2_00407809

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

2_2_0040B211

Source: C:\Users\user\Desktop\igvdwmhd.exe

Code function: 2_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

2_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\Desktop\igvdwmhd.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\igvdwmhd.exe

Source: svchost.exe, 00000001.00000002.2523985177.00000210D2302000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000001.00000002.2523985177.00000210D2302000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 15.2.ybyrikeu.exe.28e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.2950000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.2950000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.igvdwmhd.exe.2af0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.svchost.exe.2b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.igvdwmhd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.igvdwmhd.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.svchost.exe.2b80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.ybyrikeu.exe.2910000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.igvdwmhd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: igvdwmhd.exe PID: 7348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ybyrikeu.exe PID: 7800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7952, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 15.2.ybyrikeu.exe.28e0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.2950000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.2950000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.igvdwmhd.exe.2af0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.svchost.exe.2b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.igvdwmhd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.igvdwmhd.exe.29b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.svchost.exe.2b80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.ybyrikeu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.ybyrikeu.exe.2910000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.igvdwmhd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: igvdwmhd.exe PID: 7348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ybyrikeu.exe PID: 7800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7952, type: MEMORYSTR

Source: C:\Users\user\Desktop\igvdwmhd.exe	Code function: 2_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	2_2_004088B0
Source: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe	Code function: 15_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	15_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 21_2_02B888B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	21_2_02B888B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	4 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	41 Native API	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	14 Windows Service	1 Access Token Manipulation	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 Service Execution	Login Hook	14 Windows Service	2 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
igvdwmhd.exe	47%	ReversingLabs	Win32.Trojan.BotX
igvdwmhd.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\ybyrikeu.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
vanaheim.cn:443	100%	Avira URL Cloud	phishing
jotunheim.name:443	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mxs.mail.ru	94.100.180.31	true	true	unknown
mta5.am0.yahoodns.net	67.195.228.110	true	true	unknown
microsoft-com.mail.protection.outlook.com	52.101.40.26	true	true	unknown
vanaheim.cn	213.226.112.95	true	true	unknown
smtp.google.com	108.177.15.27	true	false	unknown
google.com	unknown	unknown	true	unknown
time.windows.com	unknown	unknown	true	unknown
yahoo.com	unknown	unknown	true	unknown
mail.ru	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	Avira URL Cloud: phishing	unknown
jotunheim.name:443	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.101.40.26	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
213.226.112.95	vanaheim.cn	Russian Federation	9002	RETN-ASEU	true
108.177.15.27	smtp.google.com	United States	15169	GOOGLEUS	false
67.195.228.110	mta5.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	true
94.100.180.31	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1488276
Start date and time:	2024-08-05 19:51:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	igvdwmhd.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@37/4@10/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 62 Number of non-executed functions: 256
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, MoUsoCoreWorker.exe
Excluded IPs from analysis (whitelisted): 40.119.148.38, 20.76.201.171, 20.70.246.20, 20.112.250.133, 20.236.44.162, 20.231.239.246
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: igvdwmhd.exe

Simulations

Behavior and APIs

Time	Type	Description
15:33:32	API Interceptor	6x Sleep call for process: svchost.exe modified
15:33:40	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.40.26	.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Tofsee	Browse
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse
	lhs31fcc2k0lmr.exe	Get hash	malicious	Tofsee	Browse
213.226.112.95	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
67.195.228.110	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse
	OgcktrbHkI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	data.log.exe	Get hash	malicious	Unknown	Browse
	Update-KB7390-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB6340-x86.exe	Get hash	malicious	Unknown	Browse
94.100.180.31	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
	setup.exe	Get hash	malicious	Tofsee	Browse
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	.exe	Get hash	malicious	Unknown	Browse
	ydbWyoxHsd.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mxs.mail.ru	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	setup.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	5CxmQXL0LD.exe	Get hash	malicious	SystemBC	Browse	94.100.180.31
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
mta5.am0.yahoodns.net	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	67.195.204.72
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.74
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.77
	newtpp.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.77
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.110
microsoft-com.mail.protection.outlook.com	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	.exe	Get hash	malicious	Unknown	Browse	52.101.40.26
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	setup.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
vanaheim.cn	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	setup.exe	Get hash	malicious	Tofsee	Browse	185.218.0.41
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RETN-ASEU	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	http://baghoorg.xyz	Get hash	malicious	Unknown	Browse	139.45.197.153
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	139.45.197.236
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	139.45.197.236
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	https://ky.codzika.xyz/pubg/	Get hash	malicious	Unknown	Browse	139.45.197.250
	https://plcr.com.ng/atm.php?user=21003&ref=21003	Get hash	malicious	Unknown	Browse	139.45.197.237
YAHOO-GQ1US	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	67.195.228.106
	.exe	Get hash	malicious	Unknown	Browse	67.195.228.84
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	98.137.77.194
	qD7cj0t7Ag.elf	Get hash	malicious	Mirai, Moobot	Browse	98.137.186.234
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	https://yellatism.com/click.php?key=2240o76mk7oyoycyr074&cid=cphbldi9sch0sh7da130&zone=2353135-2517555085-3576986712&campaign=395161020&type=Push&age=11&creative_id=547520&campaign_id=108855&site_id=11517&placement_id=43113822&preset_id=500	Get hash	malicious	Unknown	Browse	98.137.11.164
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	GK9sEyIS4f.elf	Get hash	malicious	Mirai	Browse	98.136.201.234
MICROSOFT-CORP-MSN-AS-BLOCKUS	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	https://www.google.com/aclk?sa=l&ai=DChcSEwiOgc__s96HAxWtIa0GHQSaKnoYABAAGgJwdg&co=1&ase=2&gclid=Cj0KCQjw8MG1BhCoARIsAHxSiQnsGgXsF9N-CTUdvkZ2OgloHU2xKGwSfDGxLDHi9ENt3nSRslGk5Z4aAjQUEALw_wcB&sig=AOD64_30gJrlZCnbDWmeAyph6Mlb_4IJhA&q&nis=4&adurl&ved=2ahUKEwjassj_s96HAxXDLkQIHVr9KdQQ0Qx6BAgtEAE	Get hash	malicious	Unknown	Browse	13.107.246.60
	ATT78758.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	BWISE Solution #24-2000091.pdf	Get hash	malicious	Unknown	Browse	52.146.76.30
	https://www.templatent.com/eur/53d926b2-0373-4a76-8641-e3f5488f632d/768e4d81-78b7-4fd9-a857-c5bae5c87179/8806a07c-707c-445d-b36c-c08aabe89fc9/login?id=eHZ4eG45M1NGWG40b2QvVmpHbE5UdUJZSWtJNTkrbE9YcjlKZERpV1VUZ3Zlbk5sM3MwTWYzMjJ0ZWpYb2VpekdKaCtMclNhd3hFRDdtd2VKSi9HM3M2bDFHRkdDd0YrdW1DNWlqTFQwc1BRd0Y5Q0lDZ0tLdys2RHVCZ2NXemVQUDdZa0laUFJlbFJsTnlkdWZsUHR4SnVUV2pZN3QyNkJXaDJSeEdWN3JJT2hHaUYwd2xqMmJ4Y05kSSsxU0ppVkc5QURXSkJKUlMxNEgvT0FIWUQvWGZFZHBvbFdhcVBXRzQxWnJ3M0RwMElNQkpsaWtXWGRMV3Y1ZHNmREVCMkxVa05HeW1qb1BSRkMrSmxpNS80Z2FWaGtJZWthYXZ6WWtaeGNIWjU5VitKZ1Vzd1pHN0VyOTJqTDFvZUYvTURlWUdvRysxd0dZZjgySXduSXM2enIwWDlmWWsxcTk2L1BvV1dGZERCcUxHazluS0kwRU9oK3lKKzJPeFU1NDRVN2N2ZVhPRHRDb3k2c1ZyTkdlR2YyUT09	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://grace-barr.filemail.com/t/Fc9Dus5d	Get hash	malicious	HTMLPhisher	Browse	52.98.241.162
	001original.eml	Get hash	malicious	Unknown	Browse	104.208.16.91
	Saic Benefits_Enrollment.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	FW Quote.msg	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
MAILRU-ASMailRuRU	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	SecuriteInfo.com.Trojan.Crypt.28917.30010.exe	Get hash	malicious	Unknown	Browse	5.61.236.163
	IISz6QDXkY.elf	Get hash	malicious	Mirai	Browse	5.61.23.77
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	7Y18r(123).exe	Get hash	malicious	Unknown	Browse	94.100.180.106
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	setup.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SecuriteInfo.com.W32.Kryptik.CI.tr.21358.1519.exe	Get hash	malicious	Unknown	Browse	5.61.236.163

Process:	C:\Users\user\Desktop\igvdwmhd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	15572992
Entropy (8bit):	4.713302845034789
Encrypted:	false
SSDEEP:	24576:gIbasG14OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOX:gItG1
MD5:	4E044BA5CE650DE4D036125F371C831D
SHA1:	FB01D78149115F4C4C297CC6575502F5365DD418
SHA-256:	97C0608034E227257A2FBDBEC942D18E466D0B170AF0E50442793C4309D7E38C
SHA-512:	83EA7BE9EE27D643E88D0CD3D09E9A3EE0569792E6F3D88572D956BAFF0A88EFF6CA88360BEF3114159A686CF936DDD010DBF360D6A61AA5535B741CBF4E4CE0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*~TQK..QK..QK..>=..rK..>=..pK..>=...K..X3..VK..QK..-K..>=..PK..>=..PK..>=..PK..RichQK..........PE..L....".d......................A......[............@..........................`C.....Ta.........................................P.....B.............................................................A..@............................................text...0........................... ..`.data...T.?......\|..................@....xevaj........B......0..............@..@.zac..........B......4..............@....rsrc........B..h...8..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.247704476547741
Encrypted:	false
SSDEEP:	24:QOaqdmuF3r3V+kWReHgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIPVxU:FaqdF7F+AAHdKoqKFxcxkFF
MD5:	9064B33E48E036AF7DB5B5302FDDE36D
SHA1:	AD85B41EFE2A4EA2223C87F242449433E842FE51
SHA-256:	4B3E23FE316D61D5E6C8B1EBF2F1FA262EC6A559CD740F9AB7CBDF52117AC83F
SHA-512:	1A73EBB4ED2D52C127788020D9E442D2A8BD8F0A44F81A832A24FE0C1D1753EEB4F3946F0F001904091DA34F3AA57DEC7D81729CF5984EDCEB35338E5EFD0D07
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. M.o.n. .. A.u.g. .. 0.5. .. 2.0.2.4. .1.5.:.3.3.:.4.0.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15572992
Entropy (8bit):	4.713302845034789
Encrypted:	false
SSDEEP:	24576:gIbasG14OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOX:gItG1
MD5:	4E044BA5CE650DE4D036125F371C831D
SHA1:	FB01D78149115F4C4C297CC6575502F5365DD418
SHA-256:	97C0608034E227257A2FBDBEC942D18E466D0B170AF0E50442793C4309D7E38C
SHA-512:	83EA7BE9EE27D643E88D0CD3D09E9A3EE0569792E6F3D88572D956BAFF0A88EFF6CA88360BEF3114159A686CF936DDD010DBF360D6A61AA5535B741CBF4E4CE0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*~TQK..QK..QK..>=..rK..>=..pK..>=...K..X3..VK..QK..-K..>=..PK..>=..PK..>=..PK..RichQK..........PE..L....".d......................A......[............@..........................`C.....Ta.........................................P.....B.............................................................A..@............................................text...0........................... ..`.data...T.?......\|..................@....xevaj........B......0..............@..@.zac..........B......4..............@....rsrc........B..h...8..............@..@........................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.7146578323586645
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	igvdwmhd.exe
File size:	14'508'544 bytes
MD5:	c9bc1db6a4cbaea0905f847035b8df57
SHA1:	4c719e43ae5aa3aedc3c495ea87bcf91c9a3f1f1
SHA256:	0af8466115f0b1e17bc2d35d10acbbec1a2162bbf497e1acacf2bd17b926f068
SHA512:	cf25a1f8532dbcb00bbce76ded3a9f04bdd3cb455f754ed25d58db143f03f897e974ad6ca04511eda5afa5b8edd9ab7e01f2342f33eb70ea484daf80283e33bc
SSDEEP:	24576:eIbasG14OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO:eItG1
TLSH:	18E6E4503AEDD499E6F24B745974F3ED212BBCABB864825F36643F0B3831746284172E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*~TQK..QK..QK..>=..rK..>=..pK..>=...K..X3..VK..QK..-K..>=..PK..>=..PK..>=..PK..RichQK..........PE..L....".d...................

File Icon


Icon Hash:	cd4d3d2e4e054d07

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 19:52:18.159456015 CEST	49701	25	192.168.2.7	52.101.40.26
Aug 5, 2024 19:52:19.163780928 CEST	49701	25	192.168.2.7	52.101.40.26
Aug 5, 2024 19:52:21.163851976 CEST	49701	25	192.168.2.7	52.101.40.26
Aug 5, 2024 19:52:21.348467112 CEST	49702	443	192.168.2.7	213.226.112.95
Aug 5, 2024 19:52:21.348505020 CEST	443	49702	213.226.112.95	192.168.2.7
Aug 5, 2024 19:52:21.348573923 CEST	49702	443	192.168.2.7	213.226.112.95
Aug 5, 2024 19:52:25.163817883 CEST	49701	25	192.168.2.7	52.101.40.26
Aug 5, 2024 19:52:33.163877010 CEST	49701	25	192.168.2.7	52.101.40.26
Aug 5, 2024 19:52:38.182869911 CEST	49708	25	192.168.2.7	67.195.228.110
Aug 5, 2024 19:52:39.179490089 CEST	49708	25	192.168.2.7	67.195.228.110
Aug 5, 2024 19:52:41.195132971 CEST	49708	25	192.168.2.7	67.195.228.110
Aug 5, 2024 19:52:45.210851908 CEST	49708	25	192.168.2.7	67.195.228.110
Aug 5, 2024 19:52:53.210906029 CEST	49708	25	192.168.2.7	67.195.228.110
Aug 5, 2024 19:52:58.216710091 CEST	49709	25	192.168.2.7	108.177.15.27
Aug 5, 2024 19:52:59.226716042 CEST	49709	25	192.168.2.7	108.177.15.27
Aug 5, 2024 19:53:01.226531029 CEST	49709	25	192.168.2.7	108.177.15.27
Aug 5, 2024 19:53:01.336157084 CEST	49702	443	192.168.2.7	213.226.112.95
Aug 5, 2024 19:53:01.336227894 CEST	443	49702	213.226.112.95	192.168.2.7
Aug 5, 2024 19:53:01.336363077 CEST	49702	443	192.168.2.7	213.226.112.95
Aug 5, 2024 19:53:01.446445942 CEST	49710	443	192.168.2.7	213.226.112.95
Aug 5, 2024 19:53:01.446492910 CEST	443	49710	213.226.112.95	192.168.2.7
Aug 5, 2024 19:53:01.446647882 CEST	49710	443	192.168.2.7	213.226.112.95
Aug 5, 2024 19:53:05.226470947 CEST	49709	25	192.168.2.7	108.177.15.27
Aug 5, 2024 19:53:13.226589918 CEST	49709	25	192.168.2.7	108.177.15.27
Aug 5, 2024 19:53:18.236073017 CEST	49712	25	192.168.2.7	94.100.180.31
Aug 5, 2024 19:53:19.242182970 CEST	49712	25	192.168.2.7	94.100.180.31
Aug 5, 2024 19:53:21.242254972 CEST	49712	25	192.168.2.7	94.100.180.31
Aug 5, 2024 19:53:25.257911921 CEST	49712	25	192.168.2.7	94.100.180.31
Aug 5, 2024 19:53:33.257894993 CEST	49712	25	192.168.2.7	94.100.180.31
Aug 5, 2024 19:53:41.445718050 CEST	49710	443	192.168.2.7	213.226.112.95
Aug 5, 2024 19:53:41.445811033 CEST	443	49710	213.226.112.95	192.168.2.7
Aug 5, 2024 19:53:41.445967913 CEST	49710	443	192.168.2.7	213.226.112.95
Aug 5, 2024 19:53:41.555610895 CEST	49713	443	192.168.2.7	213.226.112.95
Aug 5, 2024 19:53:41.555666924 CEST	443	49713	213.226.112.95	192.168.2.7
Aug 5, 2024 19:53:41.555751085 CEST	49713	443	192.168.2.7	213.226.112.95

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 19:52:12.721364975 CEST	51297	53	192.168.2.7	1.1.1.1
Aug 5, 2024 19:52:18.122225046 CEST	55340	53	192.168.2.7	1.1.1.1
Aug 5, 2024 19:52:18.158596992 CEST	53	55340	1.1.1.1	192.168.2.7
Aug 5, 2024 19:52:21.056119919 CEST	59021	53	192.168.2.7	1.1.1.1
Aug 5, 2024 19:52:21.346550941 CEST	53	59021	1.1.1.1	192.168.2.7
Aug 5, 2024 19:52:38.164603949 CEST	63972	53	192.168.2.7	1.1.1.1
Aug 5, 2024 19:52:38.172527075 CEST	53	63972	1.1.1.1	192.168.2.7
Aug 5, 2024 19:52:38.173639059 CEST	53349	53	192.168.2.7	1.1.1.1
Aug 5, 2024 19:52:38.182168007 CEST	53	53349	1.1.1.1	192.168.2.7
Aug 5, 2024 19:52:58.195938110 CEST	60658	53	192.168.2.7	1.1.1.1
Aug 5, 2024 19:52:58.205764055 CEST	53	60658	1.1.1.1	192.168.2.7
Aug 5, 2024 19:52:58.206578016 CEST	62677	53	192.168.2.7	1.1.1.1
Aug 5, 2024 19:52:58.216089964 CEST	53	62677	1.1.1.1	192.168.2.7
Aug 5, 2024 19:53:18.211545944 CEST	53535	53	192.168.2.7	1.1.1.1
Aug 5, 2024 19:53:18.226720095 CEST	53	53535	1.1.1.1	192.168.2.7
Aug 5, 2024 19:53:18.227549076 CEST	53654	53	192.168.2.7	1.1.1.1
Aug 5, 2024 19:53:18.235491037 CEST	53	53654	1.1.1.1	192.168.2.7
Aug 5, 2024 19:54:14.765954018 CEST	59776	53	192.168.2.7	1.1.1.1
Aug 5, 2024 19:54:14.808582067 CEST	53	59776	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 5, 2024 19:52:12.721364975 CEST	192.168.2.7	1.1.1.1	0x25b2	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:18.122225046 CEST	192.168.2.7	1.1.1.1	0x4c34	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:21.056119919 CEST	192.168.2.7	1.1.1.1	0x350	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:38.164603949 CEST	192.168.2.7	1.1.1.1	0x84e1	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:52:38.173639059 CEST	192.168.2.7	1.1.1.1	0x7c30	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:58.195938110 CEST	192.168.2.7	1.1.1.1	0x270f	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:52:58.206578016 CEST	192.168.2.7	1.1.1.1	0x4358	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:53:18.211545944 CEST	192.168.2.7	1.1.1.1	0x910a	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:53:18.227549076 CEST	192.168.2.7	1.1.1.1	0xd59a	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:54:14.765954018 CEST	192.168.2.7	1.1.1.1	0xad3b	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 5, 2024 19:52:12.728830099 CEST	1.1.1.1	192.168.2.7	0x25b2	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 19:52:18.158596992 CEST	1.1.1.1	192.168.2.7	0x4c34	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.40.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:18.158596992 CEST	1.1.1.1	192.168.2.7	0x4c34	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.11.0	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:18.158596992 CEST	1.1.1.1	192.168.2.7	0x4c34	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.42.0	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:18.158596992 CEST	1.1.1.1	192.168.2.7	0x4c34	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.8.49	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:21.346550941 CEST	1.1.1.1	192.168.2.7	0x350	No error (0)	vanaheim.cn		213.226.112.95	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:38.172527075 CEST	1.1.1.1	192.168.2.7	0x84e1	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:52:38.172527075 CEST	1.1.1.1	192.168.2.7	0x84e1	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:52:38.172527075 CEST	1.1.1.1	192.168.2.7	0x84e1	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:52:38.182168007 CEST	1.1.1.1	192.168.2.7	0x7c30	No error (0)	mta5.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:38.182168007 CEST	1.1.1.1	192.168.2.7	0x7c30	No error (0)	mta5.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:38.182168007 CEST	1.1.1.1	192.168.2.7	0x7c30	No error (0)	mta5.am0.yahoodns.net		67.195.204.74	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:38.182168007 CEST	1.1.1.1	192.168.2.7	0x7c30	No error (0)	mta5.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:38.182168007 CEST	1.1.1.1	192.168.2.7	0x7c30	No error (0)	mta5.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:38.182168007 CEST	1.1.1.1	192.168.2.7	0x7c30	No error (0)	mta5.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:38.182168007 CEST	1.1.1.1	192.168.2.7	0x7c30	No error (0)	mta5.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:38.182168007 CEST	1.1.1.1	192.168.2.7	0x7c30	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:58.205764055 CEST	1.1.1.1	192.168.2.7	0x270f	No error (0)	google.com			MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:52:58.216089964 CEST	1.1.1.1	192.168.2.7	0x4358	No error (0)	smtp.google.com		108.177.15.27	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:58.216089964 CEST	1.1.1.1	192.168.2.7	0x4358	No error (0)	smtp.google.com		173.194.76.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:58.216089964 CEST	1.1.1.1	192.168.2.7	0x4358	No error (0)	smtp.google.com		108.177.15.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:58.216089964 CEST	1.1.1.1	192.168.2.7	0x4358	No error (0)	smtp.google.com		74.125.133.27	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:52:58.216089964 CEST	1.1.1.1	192.168.2.7	0x4358	No error (0)	smtp.google.com		74.125.133.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:53:18.226720095 CEST	1.1.1.1	192.168.2.7	0x910a	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Aug 5, 2024 19:53:18.235491037 CEST	1.1.1.1	192.168.2.7	0xd59a	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:53:18.235491037 CEST	1.1.1.1	192.168.2.7	0xd59a	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:54:14.808582067 CEST	1.1.1.1	192.168.2.7	0xad3b	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.8.49	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:54:14.808582067 CEST	1.1.1.1	192.168.2.7	0xad3b	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.42.0	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:54:14.808582067 CEST	1.1.1.1	192.168.2.7	0xad3b	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.40.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 19:54:14.808582067 CEST	1.1.1.1	192.168.2.7	0xad3b	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.11.0	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	13:52:08
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:52:09
Start date:	05/08/2024
Path:	C:\Users\user\Desktop\igvdwmhd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\igvdwmhd.exe"
Imagebase:	0x400000
File size:	14'508'544 bytes
MD5 hash:	C9BC1DB6A4CBAEA0905F847035B8DF57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000002.00000003.1308349259.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000002.00000002.1351232837.0000000002BB9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:52:12
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	13:52:12
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ptcoklzf\
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:52:12
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:52:13
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user~1\AppData\Local\Temp\ybyrikeu.exe" C:\Windows\SysWOW64\ptcoklzf\
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:52:13
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0xeb0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:52:13
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create ptcoklzf binPath= "C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d\"C:\Users\user\Desktop\igvdwmhd.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0x10000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:52:13
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:52:14
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description ptcoklzf "wifi internet conection"
Imagebase:	0x10000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:52:14
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:52:14
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start ptcoklzf
Imagebase:	0x10000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:52:14
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:52:14
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe /d"C:\Users\user\Desktop\igvdwmhd.exe"
Imagebase:	0x400000
File size:	15'572'992 bytes
MD5 hash:	4E044BA5CE650DE4D036125F371C831D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000F.00000002.1367995778.0000000002950000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000F.00000003.1363366443.0000000002910000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.1368074204.00000000029B2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:52:15
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1770000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:52:15
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:52:15
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	13:52:15
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7348 -ip 7348
Imagebase:	0x8e0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:52:15
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 1232
Imagebase:	0x8e0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:52:17
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x610000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	13:52:17
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7800 -ip 7800
Imagebase:	0x8e0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:52:17
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 544
Imagebase:	0x8e0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:33:25
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	15:33:40
Start date:	05/08/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff7b8970000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:33:40
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	31%
Signature Coverage:	25.4%
Total number of Nodes:	1562
Total number of Limit Nodes:	18

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 0040A189
%X%08X, xrefs: 0040A0B0
", xrefs: 0040A078
D, xrefs: 00409F8E
P, xrefs: 00409DAA
", xrefs: 00409EDB
\, xrefs: 00409D0C

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,771A8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 02BBE348 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02BBE370
Module32First.KERNEL32(00000000,00000224), ref: 02BBE390

Memory Dump Source

Source File: 00000002.00000002.1351232837.0000000002BB9000.00000040.00000020.00020000.00000000.sdmp, Offset: 02BB9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bb9000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 328526aada0347e2c0714324f1f58a27de9ffa3537dd3f6c01c33d7424c2ebd6
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: CDF0F6311007146FE7223BF9988CBFE76E8FF48224F904168F643910D0CBF0E8058A60

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,771B0F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,771B0F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,771B0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,771B0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,771B0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,771B0F10,?,771B0F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(771B0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,771B0F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(771B0F10,?,771B0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(771B0F10), ref: 00407208
RegCloseKey.ADVAPI32(771B0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(771B0F10), ref: 004072D0
RegCloseKey.ADVAPI32(771B0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(771B0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,771B0F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,771B0F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,771B0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,771B0F10,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,771B0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 029B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 029B024D

Strings

cess, xrefs: 029B018D
kernel32.dll, xrefs: 029B008F, 029B0095

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 42523d658734be5adc1b1daf10dbf1cb7dd777a4bc5754a5a5006f2d178b3ac3
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 87527974A01229DFDB65CF68C984BADBBB5BF09304F1480D9E94DAB351DB30AA85CF14

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,771A8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 029B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,029B0223,?,?), ref: 029B0E19
SetErrorMode.KERNELBASE(00000000,?,?,029B0223,?,?), ref: 029B0E1E

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 8c5091a75a8c552e1507ec5e9f2876851e53a5403109e6d851cc54e5729abfa9
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 16D01236245228B7DB012AD4DC09BCEBB1CDF09BA6F008021FB0DE9080CBB09A4046EA

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 02BBE007 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02BBE058

Memory Dump Source

Source File: 00000002.00000002.1351232837.0000000002BB9000.00000040.00000020.00020000.00000000.sdmp, Offset: 02BB9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bb9000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 02195c6b06c99e32253f6f8a89b2d4abe5af32bc40b7086726dd73582e2e5f5f
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 80112B79A00208EFDB01DF98C985E98BBF5AF08351F458094FA489B361D371EA50DF80

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
wtm_w, xrefs: 0040C96C
wtm_c, xrefs: 0040C956
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
\, xrefs: 0040D39D
@, xrefs: 0040D754
lid_file_upd, xrefs: 0040CE6A
\, xrefs: 0040D3A7
.sys, xrefs: 0040D0CC
wtm_r, xrefs: 0040C97F
local_time, xrefs: 0040CACD
srv_time, xrefs: 0040CABB
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
drivers\, xrefs: 0040D067
4, xrefs: 0040D9F7
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
flags_upd, xrefs: 0040CE4A

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlLengthSid, xrefs: 00401246
RtlFreeSid, xrefs: 00401116
RtlNtStatusToDosError, xrefs: 00401194
RtlInitUnicodeString, xrefs: 00401135
NtSetInformationThread, xrefs: 00401155
NtFilterToken, xrefs: 0040122B
RtlSetLastWin32Error, xrefs: 004010D6
NtDuplicateToken, xrefs: 004011F3
NtTerminateProcess, xrefs: 004010F6
ntdll.dll, xrefs: 0040100D
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtQueryInformationToken, xrefs: 00401262
NtOpenProcessToken, xrefs: 004011D4
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtClose, xrefs: 004011B4
NtSetInformationToken, xrefs: 00401175

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Fri, xrefs: 0040B248
Thu, xrefs: 0040B241
Aug, xrefs: 0040B287
Wed, xrefs: 0040B23A
Oct, xrefs: 0040B295
Sat, xrefs: 0040B24F
Tue, xrefs: 0040B233
Mon, xrefs: 0040B22C
Apr, xrefs: 0040B26B
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Dec, xrefs: 0040B2A3
Sun, xrefs: 0040B225
Mar, xrefs: 0040B264
Feb, xrefs: 0040B25D
Sep, xrefs: 0040B28E
Jun, xrefs: 0040B279
Jan, xrefs: 0040B256
Nov, xrefs: 0040B29C
Jul, xrefs: 0040B280
May, xrefs: 0040B272

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

useless, xrefs: 0040161E
uac, xrefs: 00401628
<, xrefs: 00401378
wusa.exe, xrefs: 00401388
%systemroot%\system32\cmd.exe, xrefs: 00401316
D, xrefs: 004015C6
, xrefs: 00401462
@, xrefs: 00401380

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

loader_id, xrefs: 00401F4B, 00401F6B
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
net_type, xrefs: 00401E87
IsWow64Process, xrefs: 00401DF2
born_date, xrefs: 00401EAD, 00401ECC
kernel32, xrefs: 00401DF7
work_srv, xrefs: 00401E5E
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
start_srv, xrefs: 00401E6C
lid_file_upd, xrefs: 00401E25
hi_id, xrefs: 00401F16, 00401F1B, 00401F33

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,771AF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,771AF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 029B65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 029B65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 029B6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 029B6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 029B6652

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 2e641a22c38312b16daaee350788746e9877bd09c76a33a2abd2fb289dc01123
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 36113D71600218BFDB229F75DD49FDB3FACEF457A5F104024FA08A6250D7B1ED508AA4

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 029B092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 029B09DC, 029B09DF, 029B09E4
l, xrefs: 029B0966
., xrefs: 029B095F

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 0a66f4f24eebff46a6d1eba4c5b0f30797ab4fddd30b559a89f81ec772f921fa
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: D33148B6900609DFDB11CF99C984AEEBBF9FF48324F14414AD841A7350D771EA45CBA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 02BBDC25 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1351232837.0000000002BB9000.00000040.00000020.00020000.00000000.sdmp, Offset: 02BB9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bb9000_igvdwmhd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 8b33e426dbf5319896bdcbf7cf70dbff5fbf0c521dc9803b7dc7c0d98cb52cb4
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 09118EB2340101AFD745DF55DC91FF673EAEF89225B1980A5ED08CB315D6B9E802CB60

Function 029B0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: d368135e42564d2e68dd37a759f2409f13f1ff75548028cdd3c4d342cc0a74d6
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 1F01A276A106048FDF22CF24CA05BEB33E9FFC6616F4545A5D90A9B281E774A9418B90

Function 029B9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 029B9E6D
lstrcpy.KERNEL32(?,00000000), ref: 029B9FE1
lstrcat.KERNEL32(?,?), ref: 029B9FF2
lstrcat.KERNEL32(?,0041070C), ref: 029BA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 029BA054
DeleteFileA.KERNEL32(?), ref: 029BA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 029BA0D6
lstrcpy.KERNEL32 ref: 029BA12F
lstrlen.KERNEL32(00000022), ref: 029BA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 029B9F13

Part of subcall function 029B7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 029B7081

Part of subcall function 029B6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\aenzvwkq,029B7043), ref: 029B6F4E
Part of subcall function 029B6F30: GetProcAddress.KERNEL32(00000000), ref: 029B6F55
Part of subcall function 029B6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 029B6F7B
Part of subcall function 029B6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 029B6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 029BA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 029BA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 029BA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 029BA21B
GetDriveTypeA.KERNEL32(?), ref: 029BA265
lstrcat.KERNEL32(?,00000000), ref: 029BA29F
lstrcat.KERNEL32(?,00410A34), ref: 029BA2C5
lstrcat.KERNEL32(?,00000022), ref: 029BA2D9
lstrcat.KERNEL32(?,00410A34), ref: 029BA2F4
wsprintfA.USER32 ref: 029BA31D
lstrcat.KERNEL32(?,00000000), ref: 029BA345
lstrcat.KERNEL32(?,?), ref: 029BA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 029BA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 029BA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 029BA1D1

Part of subcall function 029B9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 029B999D
Part of subcall function 029B9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 029B99BD
Part of subcall function 029B9966: RegCloseKey.ADVAPI32(?), ref: 029B99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 029BA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 029BA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 029BA41D

Strings

", xrefs: 029BA2DF
D, xrefs: 029BA1F5
P, xrefs: 029BA011
", xrefs: 029BA142
\, xrefs: 029B9F73
", xrefs: 029BA3F0

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 9d0296501e0905c2d4e9aa8298a28ff9b280062e846319ef1dd94a5fb444024c
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 26F141B1D4025DAFDF22DBA08E48FEE7BBDAF09304F0444A6E605E2151E7759A848F64

Function 029B7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 029B7D21
GetUserNameA.ADVAPI32(?,?), ref: 029B7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029B7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 029B7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 029B7DC0
EqualSid.ADVAPI32(?,?), ref: 029B7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 029B7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029B7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 029B7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 029B7E12
LocalFree.KERNEL32(00000000), ref: 029B7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 029B7E35

Strings

D, xrefs: 029B7D73
PromptOnSecureDesktop, xrefs: 029B7FA0

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 7c7ba836c86b22620e20ab916512d3a3523af567d24313c1bda3c30b58163d96
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 06A14B72900219AFDB128FA0DE88FEEBBBDFF48744F04816AF505E6150D7758A85CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

%d=%p, xrefs: 004066F9
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
Jan 13 2018, xrefs: 0040653A
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728
plgs:, xrefs: 004066AA
va=%08X%08X uef=%p, xrefs: 00406595
12:08:32, xrefs: 00406535

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

localcfg, xrefs: 0040AB0B
data, xrefs: 0040A85E
AUTH LOGIN, xrefs: 0040A80C
helo %s, xrefs: 0040A803
quit, xrefs: 0040A86C
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
ehlo %s, xrefs: 0040A7F5
mail from:<%s>, xrefs: 0040A848
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ESMTP, xrefs: 0040AA38
., xrefs: 0040A8CA
Incorrect respons, xrefs: 0040AB39
Too small respons, xrefs: 0040A9C9
rcpt to:<%s>, xrefs: 0040A855

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 029B7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 029B7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029B7ACD
GetLengthSid.ADVAPI32(?), ref: 029B7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 029B7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 029B7B1F
EqualSid.ADVAPI32(?,?), ref: 029B7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 029B7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029B7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 029B7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 029B7B77
LocalFree.KERNEL32(00000000), ref: 029B7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 029B7B9A
GetAce.ADVAPI32(?,?,?), ref: 029B7BCA
EqualSid.ADVAPI32(?,?), ref: 029B7BF1
DeleteAce.ADVAPI32(?,?), ref: 029B7C0A
EqualSid.ADVAPI32(?,?), ref: 029B7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 029B7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 029B7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 029B7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 029B7CE0
LocalFree.KERNEL32(00000000), ref: 029B7CEE

Strings

D, xrefs: 029B7AC3

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: f654d0ebd20af280c1c699e3fd905bd77509bb0b3fcbacd0931144b6a0a99d2b
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 20813D72900219AFDB12CFE4DE88FEEBBBCAF48305F04816AE505E6250D7759A45CF64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

Iphlpapi.dll, xrefs: 004019B7
GetBestInterface, xrefs: 004019EF
localcfg, xrefs: 004019A3
123.45.67.89, xrefs: 004019A6
GetAdaptersInfo, xrefs: 004019DC
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 029B858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 029B865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 029B867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 029B86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 029B86B1

Strings

", xrefs: 029B896C
PromptOnSecureDesktop, xrefs: 029B85B6, 029B8645, 029B86BD, 029B8708, 029B87C5, 029B8812, 029B88E9, 029B8905

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 128f38fcc887b322a511e1dd8b67b7c755268c2cc85ed0bd091818acd99c2f06
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 88C17F71900149BFEF12ABA4DE89EEE7BBDEF48304F144066F604A6050E7714A948B65

Function 029B14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 029B1601
lstrlenW.KERNEL32(-00000003), ref: 029B17D8

Strings

<, xrefs: 029B15DF
, xrefs: 029B16C9
D, xrefs: 029B182D
@, xrefs: 029B15E7

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: df3caf3a0597b9f19cd2fbfeb3b8e886828a1896a4627902182df770bcccf36e
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: D4F1ACB11083819FD721CF64C998BEBB7E9FF88304F10892DF59A972A0D7B49944CB56

Function 029B7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 029B76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 029B7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 029B778F
___ascii_stricmp.LIBCMT ref: 029B78B4
RegCloseKey.ADVAPI32(?), ref: 029B794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 029B796D
RegCloseKey.ADVAPI32(?), ref: 029B797E
RegCloseKey.ADVAPI32(?), ref: 029B79AC
RegCloseKey.ADVAPI32(?), ref: 029B7A56

Part of subcall function 029BF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,029B772A,?), ref: 029BF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 029B79F6
RegCloseKey.ADVAPI32(?), ref: 029B7A4D

Strings

", xrefs: 029B7800
PromptOnSecureDesktop, xrefs: 029B76C5, 029B76CA, 029B76E5, 029B7782, 029B77E6, 029B7862, 029B787B, 029B79C2

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 6f5b54e8bedef0f98781eeb8a28d7cd6d8db4efced1db3dc229972a8566402c9
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 52C17372900209AFDB12DBE4DE44FEEBBBDEF89710F1441A5E544E6190EB71DA84CB60

Function 029B2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 029B2CED
socket.WS2_32(00000002,00000002,00000011), ref: 029B2D07
htons.WS2_32(00000000), ref: 029B2D42
select.WS2_32 ref: 029B2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 029B2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 029B2E62

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: a844754e445bd0e1a5e81102e49a2f9bdfbb3dfbc358388cf5ba20d742e5a797
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 9A61EF71904305ABC322AF65DD08BEBBBECEF88745F004829FD8497160D7B4D880CBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%s%d, xrefs: 0040AE58
127.0.0.1, xrefs: 0040ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_HST, xrefs: 0040AEC5

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,771B23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 029B958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 029B95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 029B95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 029B95DC
wsprintfA.USER32 ref: 029B9635
wsprintfA.USER32 ref: 029B9673
wsprintfA.USER32 ref: 029B96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 029B9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 029B978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 029B97D8

Strings

PromptOnSecureDesktop, xrefs: 029B9604, 029B9624, 029B9662, 029B9683, 029B96B6, 029B96DF, 029B9701, 029B9734, 029B9780, 029B97B7

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: b001f930b03aa73000ae96becf5d14f5538d158dcdeb970be76d510faaee7d44
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 16A16AB295020CAFEB22DFA0CD85FDA3BADEF48740F104026FA15A6151E7B5D584CFA4

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
06A, xrefs: 0040BF70
46A, xrefs: 0040BF85
smtp_retr, xrefs: 0040BE61, 0040BF8C
86A, xrefs: 0040BF98
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_USER, xrefs: 0040B488
%TO_HASH, xrefs: 0040B4B0
%TO_EMAIL, xrefs: 0040B473
%TO_DOMAIN, xrefs: 0040B44B
%DATE, xrefs: 0040B4D2
%s@%s, xrefs: 0040B461
%FROM_EMAIL, xrefs: 0040B3E9
%P5DATE, xrefs: 0040B4F2
%FROM_USER, xrefs: 0040B431
%M5DATE, xrefs: 0040B50F
%FROM_DOMAIN, xrefs: 0040B41E

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 029B1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 029B202D
GetSystemInfo.KERNEL32(?), ref: 029B204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 029B206A
GetProcAddress.KERNEL32(00000000), ref: 029B2071
GetCurrentProcess.KERNEL32(?), ref: 029B2082
GetTickCount.KERNEL32 ref: 029B2230

Part of subcall function 029B1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 029B1E7C

Strings

flags_upd, xrefs: 029B20A5, 029B20AA, 029B20E3
localcfg, xrefs: 029B2091, 029B2098, 029B20AB, 029B20E4, 029B20F3, 029B2119, 029B2138, 029B214E, 029B2166, 029B2183, 029B219B, 029B21B7, 029B21D7
hi_id, xrefs: 029B217D, 029B2182, 029B219A
work_srv, xrefs: 029B20C5

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: ad89a558a526af43ddb215cb195e7ef56d43268a244c1e1827628b41dc779185
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 1E5137B0900348AFE332AF758D84FE7BAECEF85704F40491DF99692142D7B8A544CB65

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7686EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7686EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 029B3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 029B3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 029B3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 029B3095
RtlAllocateHeap.NTDLL(00000000), ref: 029B30B6
htons.WS2_32(00000035), ref: 029B30EF
inet_addr.WS2_32(?), ref: 029B30FA
gethostbyname.WS2_32(?), ref: 029B310D
HeapFree.KERNEL32(00000000), ref: 029B314D

Strings

iphlpapi.dll, xrefs: 029B3062, 029B3067, 029B3077

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: a34baf1f08ff3a42c0dd7040d1b1c7549d64c0ca321ca18b9277bb9fac303ece
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: BF31B631A00206BBDB12DBB89D48BEE77BCEF05764F1441A5E918E7290DB74D541CB5C

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 029B6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 029B67C3
htonl.WS2_32(?), ref: 029B67DF
htonl.WS2_32(?), ref: 029B67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 029B68F1
ExitProcess.KERNEL32 ref: 029B69BC

Strings

localcfg, xrefs: 029B6994
except_info, xrefs: 029B698F

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 252678702cf82b402801c59cd2f9c6b4ca81ac2595015a62932f1b0a42368217
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: B3616E71940208AFDF619FA4DC45FEA77E9FF48300F148066FA6DD2161DB75A9908F14

Function 029BF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(029BCC84), ref: 029BF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 029BF5CE
closesocket.WS2_32(00000000), ref: 029BF5DC

Strings

time_cfg, xrefs: 029BF58A

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: c36697e206fae3cdf7e980bad387d8d87737c7ecd7eaa711cf87e197ec3a304b
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 10318C7290011CABDB12DFB5DD88DEEBBBCEF88314F104566F905E3150E7708A818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 029B2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 029B2FA1
LoadLibraryA.KERNEL32(?), ref: 029B2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 029B2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 029B3000
RtlAllocateHeap.NTDLL(00000000), ref: 029B3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 029B3032

Strings

dnsapi.dll, xrefs: 029B2F90

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 70892c50e9f0fef74d2f2dd83acb9e5615e6e99a6c72556d0a2db01196819b8f
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 8F21A171D01229BBCB22DF54DD88AEEBBBCEF08B50F004461F901E7540D7B49A8187E4

Function 029B6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\aenzvwkq,029B7043), ref: 029B6F4E
GetProcAddress.KERNEL32(00000000), ref: 029B6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 029B6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 029B6F92

Strings

C:\Windows\SysWOW64\, xrefs: 029B6F30, 029B6F38, 029B6F65, 029B6F6C, 029B6F7A, 029B6F85, 029B6F91, 029B6FA9, 029B6FC6, 029B6FEC
\\.\pipe\aenzvwkq, xrefs: 029B6F37
PromptOnSecureDesktop, xrefs: 029B6F9D, 029B6FBF, 029B6FCF, 029B6FE5, 029B6FF5

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\aenzvwkq
API String ID: 1082366364-1787891232
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 5b80198d06729259e56e476fa3693be4d4e72ab31c98098d4ae44dd958e85e30
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 8D2102227413447AF72353359E8CFFB3E4D8F92B24F1880A6F944E6490DBD994D682AD

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 029B92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 029B92E2
wsprintfA.USER32 ref: 029B9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 029B9375
lstrlen.KERNEL32(?,?,00000000), ref: 029B9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 029B9394
CloseHandle.KERNEL32(00000000), ref: 029B939B

Strings

PromptOnSecureDesktop, xrefs: 029B932B, 029B9343, 029B935E

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: d971f06e0db10fb17e1b9cf8529f5022460c67be7a2fcb7cdf31ea2048674fb6
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: E81172B16401147BE7216B31ED0DFEF3A6EDFC9B10F008065BB09A5091EAB54E418A64

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 029B99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 029B9A18
GetThreadContext.KERNEL32(?,?), ref: 029B9A52
TerminateProcess.KERNEL32(?,00000000), ref: 029B9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 029B9A98
SetThreadContext.KERNEL32(?,00010002), ref: 029B9AB5
ResumeThread.KERNEL32(?), ref: 029B9AC2

Strings

D, xrefs: 029B9A10

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 449f0eba3b288d6ad1fe802a7e411e42e269c3f35a46c60dd6b4c4e49e3e0bf3
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 1B213BB1A01219BBEB129BA1DD09EEFBBBCEF05750F404061BA19E5050E7759A84CFA4

Function 029B1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 029B1C18
LoadLibraryA.KERNEL32(004102C8), ref: 029B1C26
GetProcessHeap.KERNEL32 ref: 029B1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 029B1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 029B1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 029B1D02
FreeLibrary.KERNEL32(?), ref: 029B1D0B

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 93ec63b452a1e726b86677f70ec18d0d73d7beef71ff0b516573d3844ca42d18
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: C7315E31E00209BFCB129FE4DE988EEBBB9EF85705F24447AE509E2110D7B54E80DB94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 029B6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 029B6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 029B6D22
GetLastError.KERNEL32 ref: 029B6DA7
CloseHandle.KERNEL32(?), ref: 029B6DB5
GetLastError.KERNEL32 ref: 029B6DD6
DeleteFileA.KERNEL32(?), ref: 029B6DE7
GetLastError.KERNEL32 ref: 029B6DFD

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 8b323eb0eddfb865d11c9424e8aac627905ba7559ee8614626d6975b43b5d16d
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 5131E176900249BFCB02DFA4DE48ADE7F7DEF88310F148476E251E3250D770AA958B65

Function 029B93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 029B93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 029B93CD
CharToOemA.USER32(?,?), ref: 029B93DB
wsprintfA.USER32 ref: 029B9410

Part of subcall function 029B92CB: GetTempPathA.KERNEL32(00000400,?), ref: 029B92E2
Part of subcall function 029B92CB: wsprintfA.USER32 ref: 029B9350
Part of subcall function 029B92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 029B9375
Part of subcall function 029B92CB: lstrlen.KERNEL32(?,?,00000000), ref: 029B9389
Part of subcall function 029B92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 029B9394
Part of subcall function 029B92CB: CloseHandle.KERNEL32(00000000), ref: 029B939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 029B9448

Strings

PromptOnSecureDesktop, xrefs: 029B93FA, 029B93FF, 029B941C

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: c6c1ec20cdbecd40651e6a05e1a5bec1c252ce1a6c8c2fe8c6c113f18cfb704d
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 33015EF69001187BEB21A7619E8DEDF3B7CDB95701F0040A2BB49E2080EAB497C58F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 029BAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 029BAAE5

Strings

localcfg, xrefs: 029BAD72
, xrefs: 029BABB3

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: cfd63c9f51d115d1a3a7bdd0ca8150eef1c3339cb8dc1f674b8cd26bf15dc2df
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: FF713B71A00318BADF338B58DE85FEE376DAF81709F244467F904A6090DF7295C48B59

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 029BE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 029BDF6C: GetCurrentThreadId.KERNEL32 ref: 029BDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 029BE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,029B6128), ref: 029BE950
lstrcmp.KERNEL32(?,00000008), ref: 029BE989

Strings

A, xrefs: 029BE9A0
A, xrefs: 029BE960, 029BE965
A, xrefs: 029BE8C6, 029BE8CD, 029BE936, 029BE998

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: de33c884d5404985c5aea482ab15409ab6ba6d6156173993e0edb9d6f5071644
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 5831B231A007059BDF738F24C9847E67BECEF09715F80892AE5D687551D374E888CB91

Function 029B6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 029B6E19

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 269d167a4fa46e2f1865d4837adcbfaaa042f403356f295e4d73e0c557cbf7ac
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 37212E7A104119BFDB129BB0FE48EDF7FADEF49665B108425F502D1090EB70EA509B74

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,771B0F10,?,00000000,0040E538,?,771B0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 029BC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 029BC6B4
InterlockedIncrement.KERNEL32(029BC74B), ref: 029BC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,029BC747), ref: 029BC728
CloseHandle.KERNEL32(00000000,?,029BC747,00413588,029B8A77), ref: 029BC733

Strings

localcfg, xrefs: 029BC544

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: bec825192b39cae195558dc7e12f6a7e09e74ab2b81729216591cbf9874febf6
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: FE514AB1A01B468FD7258F69C6D466ABBE9FF88304B50593FE18BC7A90D774E840CB10

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,771B0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 029BE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,029BE50A,00000000,00000000,00000000,00020106,00000000,029BE50A,00000000,000000E4), ref: 029BE319
RegSetValueExA.ADVAPI32(029BE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029BE38E
RegDeleteValueA.ADVAPI32(029BE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029BE3BF
RegCloseKey.ADVAPI32(029BE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,029BE50A), ref: 029BE3C8

Strings

PromptOnSecureDesktop, xrefs: 029BE33A

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 9d76c320faad90ea19956aa9fab8038ea3668973ae80c17f05a3b634b1221a7c
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: E3214A71A0021DBBDF229FA4ED89EEE7F7DEF08750F008021F944A6160E3718A54DBA0

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 029B71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 029B71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 029B7228
LocalFree.KERNEL32(?,?,?), ref: 029B7286
wsprintfA.USER32 ref: 029B729D

Strings

|, xrefs: 029B721A

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 464caa247c195e7534b5bb02cc54ca1f80958e5cce00a0371cebc8f276fa4088
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 9F312972A00208BFDB02DFA8DD45BDA7BACEF44314F14C166F959DB240EB75D6488BA4

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 029BB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 029BB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 029BB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 029BB548
GetTimeZoneInformation.KERNEL32(?), ref: 029BB590
wsprintfA.USER32 ref: 029BB61E

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 724ddb351160e7a98ca85c30cafe30d6e01b5a0d55529ddfa370c3705feaab14
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 5C511EB1D0021CAACF15DFD5D9889EEBBB9BF48304F10856AE505A6150E7F84AC9CF98

Function 029B62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 029B6303
LoadLibraryA.KERNEL32(?), ref: 029B632A
GetProcAddress.KERNEL32(00000000,?), ref: 029B63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 029B6405

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: aad41257da8cabcb71046fe7f354872aea0c2073ae96a8a25e94b59b3bd7ad9d
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 3B417971A00609ABDB16CF58CA84BEDBBBDFF04318F188469E969D7290E731F940CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(771B0F18,00000000,?,771B0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,771B0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,771B0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 029BE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 029BDF6C: GetCurrentThreadId.KERNEL32 ref: 029BDFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,029BA6AC), ref: 029BE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,029BA6AC), ref: 029BE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,029BA6AC), ref: 029BE819

Strings

PromptOnSecureDesktop, xrefs: 029BE840, 029BE845, 029BE87C, 029BE89B

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: d6e9b282dc8568db452486c088d9ea86cdff918c519168309b7c6df57c138980
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: D32127B1A003047AF6237735AE49FEB3E0DDFA5B60F500034FA49B55D3EAA594508AB9

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,771B0F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,771B0F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,771B0F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 029B7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 029B76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 029B796D
RegCloseKey.ADVAPI32(?), ref: 029B797E

Strings

PromptOnSecureDesktop, xrefs: 029B76C5, 029B76CA, 029B76E5

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: ef94afd45ec1076651251536969ba03c45657d08baa4c1dd71f67a8475297232
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: E811DC32A00109AFDB128FA9DD44FEFBF7DEF86704F140261F510E6290E3B089408B61

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 029B9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 029B999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 029B99BD
RegCloseKey.ADVAPI32(?), ref: 029B99C6

Strings

PromptOnSecureDesktop, xrefs: 029B9989, 029B998E, 029B99B0, 029B99D3

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: e7075a9d172f9563088b878039ea5a8e8b19e09ea91dffb2c3ee4635050989d4
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 3DF0F6B2A80208BBF7116B54ED46FDB3A2CDF95B10F104060FA05B5091F6E59A9086BD

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 029B28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 029B28FA
gethostbyname.WS2_32(u6A), ref: 029B2906

Strings

u6A, xrefs: 029B28EC, 029B28F9, 029B2905
time_cfg, xrefs: 029B28EB

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: e12e3185b9d493d41d2444881e38ff6fe0016d23374082560665e496e5f71b62
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: DCE0C230A041119FCB018B2CF948AC537E8EF0A230F008580F844C31A0C734DCC09780

Function 029B69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 029B69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 029B6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 029B6A3A
CloseHandle.KERNEL32(000000FF), ref: 029B6BD8

Part of subcall function 029BEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,029B1DCF,?), ref: 029BEEA8
Part of subcall function 029BEE95: HeapFree.KERNEL32(00000000), ref: 029BEEAF

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 37a56a69097bbaca44971f93b24aa9fc4b056b55e35b644095545d563b4f8c0d
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 1C71057190422DEFDF129FA4CD80AEEBBBDFF08354F10456AE515A6190D730AE92DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 029B41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 029B421F
GetLastError.KERNEL32 ref: 029B4229
WaitForSingleObject.KERNEL32(?,?), ref: 029B423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 029B424D

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 1583882053477f464152fbe648e7064e94fafd86c941f07aa2be2d7e6cc1a3b1
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: E801A572911109ABDF02DF90EE84BEE7BACEF08255F108461F901E6051D7709A54ABB6

Function 029B417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 029B41AB
GetLastError.KERNEL32 ref: 029B41B5
WaitForSingleObject.KERNEL32(?,?), ref: 029B41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 029B41D9

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 0bf8d5b814dfd0e2f984cb7a65127b0e70dc19d50f841843927de349a85ea806
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: A6010C7691110AAFDF02DF90EE84BEF7B6CEF18255F004061F905E2051D770DA549BB5

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 029BE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 029BE066

Strings

A, xrefs: 029BE07F
A, xrefs: 029BE036
A, xrefs: 029BE037, 029BE03C

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 4c529f75edd2e8cfe3e5ce6fd2df7b88aaa4afb1ac67e450f00f64224b4967f4
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 5EF062312047069BCB22CF25D984AD2B7FDFF05325B84862AE595C3060D374A498CB55

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 029BE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,029B44E2,00000000,00000000,00000000), ref: 029BE470
CloseHandle.KERNEL32(00000001,00000003), ref: 029BE484

Part of subcall function 029BE2FC: RegCreateKeyExA.ADVAPI32(80000001,029BE50A,00000000,00000000,00000000,00020106,00000000,029BE50A,00000000,000000E4), ref: 029BE319
Part of subcall function 029BE2FC: RegSetValueExA.ADVAPI32(029BE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029BE38E
Part of subcall function 029BE2FC: RegDeleteValueA.ADVAPI32(029BE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 029BE3BF
Part of subcall function 029BE2FC: RegCloseKey.ADVAPI32(029BE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,029BE50A), ref: 029BE3C8

Strings

PromptOnSecureDesktop, xrefs: 029BE4F1, 029BE4F6, 029BE537, 029BE561

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: bcb20d6c6b0d9502d3813669cb1dd65ff94b44909dfcd9bdd8c423c61b675e4f
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 6B413AB2D00208BBEF226F518E45FEB3F6DEF45764F408125FE0894091E7B59650CAB4

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 029B8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 029B83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 029B8477

Part of subcall function 029B69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 029B69E5
Part of subcall function 029B69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 029B6A26
Part of subcall function 029B69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 029B6A3A

Part of subcall function 029BEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,029B1DCF,?), ref: 029BEEA8
Part of subcall function 029BEE95: HeapFree.KERNEL32(00000000), ref: 029BEEAF

Strings

PromptOnSecureDesktop, xrefs: 029B83B2, 029B83B7, 029B8483

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 058d2e2d666173b218db3641edf9ac7209f9ca70d6ccf167a095350667d46fca
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 21417FB2901109BFEB12EBA09F84EFF776EFF48344F0444A6E508D6050E7B05A948B64

Function 029BE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,029BE859,00000000,00020119,029BE859,PromptOnSecureDesktop), ref: 029BE64D
RegCloseKey.ADVAPI32(029BE859,?,?,?,?,000000C8,000000E4), ref: 029BE787

Strings

PromptOnSecureDesktop, xrefs: 029BE637

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 3c2d0fbef72c9dfe7e0e6f34c9e6c9280ce7bc3d8b16ed3aa8b90b5dc213d095
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 6C4117B2D0011DBFDF12AFA4DD85EEEBB7EFF04304F504466EA00A6160E3719A559B60

Function 029BAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 029BAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 029BB00D

Part of subcall function 029BAF6F: gethostname.WS2_32(?,00000080), ref: 029BAF83
Part of subcall function 029BAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 029BAFE6

Part of subcall function 029B331C: gethostname.WS2_32(?,00000080), ref: 029B333F
Part of subcall function 029B331C: gethostbyname.WS2_32(?), ref: 029B3349

Part of subcall function 029BAA0A: inet_ntoa.WS2_32(00000000), ref: 029BAA10

Strings

%OUTLOOK_BND_, xrefs: 029BB076, 029BB07B, 029BB0BE, 029BB0DD

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: be7d2e97a8a8cedca03450c7ab4067071aee5f4092de5c340df3a6be6ba360d5
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: C041317290020CABDB26EFA0DD45EEE3BADFF48304F144426F92992151EA75D654CF54

Function 029B9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 029B9536
Sleep.KERNEL32(000001F4), ref: 029B955D

Strings

, xrefs: 029B94D9

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 1cef30d1c57343924a909a52278edcb6d428be0b9a691c09745483575441051d
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 3F4125718583986EFB378B64DA8C7E63BAD9F02314F1400A5DA86871A2D7F44980CF11

Function 029BBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 029BB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 029BBA3A
InterlockedIncrement.KERNEL32(?), ref: 029BBA94
GetTickCount.KERNEL32 ref: 029BBB79
GetTickCount.KERNEL32 ref: 029BBB99
InterlockedIncrement.KERNEL32(?), ref: 029BBE15
closesocket.WS2_32(00000000), ref: 029BBEB4

Strings

%FROM_EMAIL, xrefs: 029BBC7D

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 2d9468a872f1de813176799bfbeafec710fd1fcee8303e8f3e7621881576d352
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 07317C71500248DFDF26DFA4DE98BEDB7A9EF88704F20446AFA24821A0DB34D685CF50

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 029B709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 029B70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 029B70F4

Strings

|, xrefs: 029B70E6

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 9175a348efa739e0004460cb552a100cf30286f3c4aaeb23d62e2edb7989c23b
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: E411FA73900118EBDB12CBD4DD84AEEB7BDAF44719F1442A6E501E6194D7709B88CBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7686EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 029B3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 029B2F88: GetModuleHandleA.KERNEL32(?), ref: 029B2FA1
Part of subcall function 029B2F88: LoadLibraryA.KERNEL32(?), ref: 029B2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 029B31DA
HeapFree.KERNEL32(00000000), ref: 029B31E1

Memory Dump Source

Source File: 00000002.00000002.1350570395.00000000029B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_29b0000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 458f2a3c6801884b0a0f90d64a1ec5e32411f1e96aa837dc75be210740d6b19e
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: B7518A7190024AEFCB02DF64DD88AFAB779FF05304B1445A9EC9687220E7329A19CB94

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000002.00000002.1349305263.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1349305263.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_igvdwmhd.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: ybyrikeu.exePID: 7800, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	30.5%
Signature Coverage:	0%
Total number of Nodes:	1576
Total number of Limit Nodes:	14

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\igvdwmhd.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

\, xrefs: 00409D0C
P, xrefs: 00409DAA
%X%08X, xrefs: 0040A0B0
", xrefs: 0040A189
D, xrefs: 00409F8E
", xrefs: 00409EDB
C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 0040A1D9
", xrefs: 0040A078
C:\Users\user\Desktop\igvdwmhd.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
ptcoklzf, xrefs: 0040A389, 0040A397

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\igvdwmhd.exe$C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe$D$P$\$ptcoklzf
API String ID: 2089075347-1790027639
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,771B0F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,771B0F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,771B0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,771B0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,771B0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 028E003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 028E024D

Strings

kernel32.dll, xrefs: 028E008F, 028E0095
cess, xrefs: 028E018D

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 7c09f1d2d0eeecdccc9fdca5e850ce5dd99776932fc0b2e5381126aa200c8370
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 6B527B78A01229DFDB64CF58C984BACBBB1BF09304F1484D9E44EAB351DB70AA85CF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 029B7160 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 029B7188
Module32First.KERNEL32(00000000,00000224), ref: 029B71A8

Memory Dump Source

Source File: 0000000F.00000002.1368074204.00000000029B2000.00000040.00000020.00020000.00000000.sdmp, Offset: 029B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b2000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: cbff4820861b9a82bb7346e70bebe85d80d4056e3c00dbe15151e117bd004b39
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: D9F0F6321003147FE7313BF4998CBEEB2ECAF88224F100228E642910C0DB70E8058A70

Function 028E0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,028E0223,?,?), ref: 028E0E19
SetErrorMode.KERNELBASE(00000000,?,?,028E0223,?,?), ref: 028E0E1E

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 1c072a56b2d644ec7deb6d0f39edbe5c90f887f2c3a704af385fe71bd3dcba02
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: DCD0123514512877DB003A94DC09BCD7B1CDF05B66F008421FB0DE9080C7B0954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 029B6E1F Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 029B6E70

Memory Dump Source

Source File: 0000000F.00000002.1368074204.00000000029B2000.00000040.00000020.00020000.00000000.sdmp, Offset: 029B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_29b2000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: f180e687d4b9678f3b2094c02a5ba7f61b317aa1484ae4d43e46b2ea9b1806a8
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 66113C79A00208EFDB01DF98CA85E99BBF5AF08750F058094F9489B361D371EA50DF90

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 028E65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 028E65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 028E6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 028E6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 028E6652

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: ed7f85a96e4cd9cb746a9722703979391229d3fcea32e67809806f1a66ca25bd
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 221154B9600228BFDB119F65DC45F9B3FACEB057A5F114024FA09D7291E7B1DD008AA4

Function 028E9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 028E9E6D
lstrcpy.KERNEL32(?,00000000), ref: 028E9FE1
lstrcat.KERNEL32(?,?), ref: 028E9FF2
lstrcat.KERNEL32(?,0041070C), ref: 028EA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 028EA054
DeleteFileA.KERNEL32(?), ref: 028EA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 028EA0D6
lstrcpy.KERNEL32 ref: 028EA12F
lstrlen.KERNEL32(00000022), ref: 028EA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 028E9F13

Part of subcall function 028E7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 028E7081

Part of subcall function 028E6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\aenzvwkq,028E7043), ref: 028E6F4E
Part of subcall function 028E6F30: GetProcAddress.KERNEL32(00000000), ref: 028E6F55
Part of subcall function 028E6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 028E6F7B
Part of subcall function 028E6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 028E6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 028EA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 028EA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 028EA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 028EA21B
GetDriveTypeA.KERNEL32(?), ref: 028EA265
lstrcat.KERNEL32(?,00000000), ref: 028EA29F
lstrcat.KERNEL32(?,00410A34), ref: 028EA2C5
lstrcat.KERNEL32(?,00000022), ref: 028EA2D9
lstrcat.KERNEL32(?,00410A34), ref: 028EA2F4
wsprintfA.USER32 ref: 028EA31D
lstrcat.KERNEL32(?,00000000), ref: 028EA345
lstrcat.KERNEL32(?,?), ref: 028EA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 028EA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 028EA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 028EA1D1

Part of subcall function 028E9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 028E999D
Part of subcall function 028E9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 028E99BD
Part of subcall function 028E9966: RegCloseKey.ADVAPI32(?), ref: 028E99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 028EA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 028EA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 028EA41D

Strings

P, xrefs: 028EA011
\, xrefs: 028E9F73
", xrefs: 028EA142
", xrefs: 028EA3F0
", xrefs: 028EA2DF
D, xrefs: 028EA1F5

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 23d11430cd6d42380bcdf6fcf563549d2a8cb3faf71cef5edfacead39a39126a
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 07F164B9D40259EFDF15DBA4CC48FEF7BBCAB0A704F0444A5E60AE2041E7B586848F65

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlInitUnicodeString, xrefs: 00401135
NtClose, xrefs: 004011B4
RtlLengthSid, xrefs: 00401246
NtQueryInformationToken, xrefs: 00401262
NtSetInformationThread, xrefs: 00401155
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
ntdll.dll, xrefs: 0040100D
NtDuplicateToken, xrefs: 004011F3
NtOpenProcessToken, xrefs: 004011D4
NtFilterToken, xrefs: 0040122B
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlSetLastWin32Error, xrefs: 004010D6
NtSetInformationToken, xrefs: 00401175
RtlNtStatusToDosError, xrefs: 00401194
RtlFreeSid, xrefs: 00401116
NtTerminateProcess, xrefs: 004010F6

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Nov, xrefs: 0040B29C
Thu, xrefs: 0040B241
Dec, xrefs: 0040B2A3
Oct, xrefs: 0040B295
May, xrefs: 0040B272
Jun, xrefs: 0040B279
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Jan, xrefs: 0040B256
Aug, xrefs: 0040B287
Mon, xrefs: 0040B22C
Feb, xrefs: 0040B25D
Jul, xrefs: 0040B280
Sat, xrefs: 0040B24F
Fri, xrefs: 0040B248
Sun, xrefs: 0040B225
Apr, xrefs: 0040B26B
Mar, xrefs: 0040B264
Wed, xrefs: 0040B23A
Tue, xrefs: 0040B233
Sep, xrefs: 0040B28E

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe$D
API String ID: 2976863881-1536157608
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 028E7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 028E7D21
GetUserNameA.ADVAPI32(?,?), ref: 028E7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 028E7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 028E7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 028E7DC0
EqualSid.ADVAPI32(?,?), ref: 028E7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 028E7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 028E7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 028E7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 028E7E12
LocalFree.KERNEL32(00000000), ref: 028E7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 028E7E35

Strings

C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 028E7F49, 028E7F76, 028E7F8A, 028E7F8B
D, xrefs: 028E7D73

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe$D
API String ID: 2976863881-1536157608
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: fd35c7bdf1075b7e73c4aca562ad751efcbe638d9981088f1661011fac9848a3
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: ADA17C79900209AFDF21DFA0DC88FEEBBB9FB0A704F048169E506E6150D7758A84CB64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
%d=%p, xrefs: 004066F9
12:08:32, xrefs: 00406535
except_info, xrefs: 00406728
Jan 13 2018, xrefs: 0040653A
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
plgs:, xrefs: 004066AA
localcfg, xrefs: 0040672D
va=%08X%08X uef=%p, xrefs: 00406595
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

ehlo %s, xrefs: 0040A7F5
Too small respons, xrefs: 0040A9C9
localcfg, xrefs: 0040AB0B
Too big smtp respons (%d bytes), xrefs: 0040A9B1
quit, xrefs: 0040A86C
., xrefs: 0040A8CA
Incorrect respons, xrefs: 0040AB39
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
ESMTP, xrefs: 0040AA38
AUTH LOGIN, xrefs: 0040A80C
data, xrefs: 0040A85E
rcpt to:<%s>, xrefs: 0040A855
mail from:<%s>, xrefs: 0040A848
helo %s, xrefs: 0040A803

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 028E7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 028E7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 028E7ACD
GetLengthSid.ADVAPI32(?), ref: 028E7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 028E7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 028E7B1F
EqualSid.ADVAPI32(?,?), ref: 028E7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 028E7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 028E7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 028E7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 028E7B77
LocalFree.KERNEL32(00000000), ref: 028E7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 028E7B9A
GetAce.ADVAPI32(?,?,?), ref: 028E7BCA
EqualSid.ADVAPI32(?,?), ref: 028E7BF1
DeleteAce.ADVAPI32(?,?), ref: 028E7C0A
EqualSid.ADVAPI32(?,?), ref: 028E7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 028E7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 028E7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 028E7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 028E7CE0
LocalFree.KERNEL32(00000000), ref: 028E7CEE

Strings

D, xrefs: 028E7AC3

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: f6a56185e6758f9c1b769e80de1dd7da57763cf99c2f87f7b85cf13bff95aaf5
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: D1813B79900219ABEF21CFA4DD84FEEBBBCEF09304F04816AE50AE6150D7759641CB64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 004085C8, 004085D5, 004085E5
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe$localcfg
API String ID: 237177642-1805428051
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

%systemroot%\system32\cmd.exe, xrefs: 00401316
D, xrefs: 004015C6
, xrefs: 00401462
uac, xrefs: 00401628
<, xrefs: 00401378
@, xrefs: 00401380
useless, xrefs: 0040161E
wusa.exe, xrefs: 00401388

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

net_type, xrefs: 00401E87
lid_file_upd, xrefs: 00401E25
IsWow64Process, xrefs: 00401DF2
born_date, xrefs: 00401EAD, 00401ECC
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
work_srv, xrefs: 00401E5E
loader_id, xrefs: 00401F4B, 00401F6B
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
kernel32, xrefs: 00401DF7
start_srv, xrefs: 00401E6C

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetIfEntry, xrefs: 004019E4
GetAdaptersInfo, xrefs: 004019DC
Iphlpapi.dll, xrefs: 004019B7
123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 028E858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 028E865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 028E867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 028E86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 028E86B1

Strings

", xrefs: 028E896C
C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 028E882F, 028E883C, 028E884C

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe
API String ID: 237177642-2855230621
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: fe6dccd64ba0efc02efe78e5e9609d7f96b8c296fc0eaa52937ac242fd333bb5
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: CFC1B2BD900149BEEF11ABA4DD85EEF7BBDEB06304F144065FA06E2060E7718A948F65

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,771AF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,771AF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 028E14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 028E1601
lstrlenW.KERNEL32(-00000003), ref: 028E17D8

Strings

D, xrefs: 028E182D
<, xrefs: 028E15DF
, xrefs: 028E16C9
@, xrefs: 028E15E7

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 114aa46676a785925a6ccee770d36c9b576ec75a5aa8d8ca1498b6f8ca1942d6
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 01F1BCB81083419FDB20DF64C888BABB7E5FB8A705F40892DF59AD7290D7B49D44CB52

Function 028E7666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 028E76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 028E7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 028E778F
___ascii_stricmp.LIBCMT ref: 028E78B4
RegCloseKey.ADVAPI32(?), ref: 028E794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 028E796D
RegCloseKey.ADVAPI32(?), ref: 028E797E
RegCloseKey.ADVAPI32(?), ref: 028E79AC
RegCloseKey.ADVAPI32(?), ref: 028E7A56

Part of subcall function 028EF40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,028E772A,?), ref: 028EF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 028E79F6
RegCloseKey.ADVAPI32(?), ref: 028E7A4D

Strings

", xrefs: 028E7800

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: a012001806d5b468a3e9118ff341f311230cec833829fae0dded368480aa82a7
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 50C1B47D900219AFEF11DBA8DC44FEEBBB9EF5A314F1040A5E506E6150EB74DA80CB61

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,771B0F10,?,771B0F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(771B0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,771B0F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(771B0F10,?,771B0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(771B0F10), ref: 00407208
RegCloseKey.ADVAPI32(771B0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(771B0F10), ref: 004072D0
RegCloseKey.ADVAPI32(771B0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(771B0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 028E2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 028E2CED
socket.WS2_32(00000002,00000002,00000011), ref: 028E2D07
htons.WS2_32(00000000), ref: 028E2D42
select.WS2_32 ref: 028E2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 028E2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 028E2E62

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: aedb246e5cf3382b172704470dc0da6e14e5895cfdeb0e3493558600da1aa556
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 2D61047D50431AABCB20AF64CC08B6BBBECEB86355F004819FD4AD7151D7B4D880CBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%s%d, xrefs: 0040AE58
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_HST, xrefs: 0040AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
127.0.0.1, xrefs: 0040ADEB

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,771B23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,771B0F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,771B0F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,771B0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,771B0F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,771B0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_DOMAIN, xrefs: 0040B41E
%TO_DOMAIN, xrefs: 0040B44B
%TO_EMAIL, xrefs: 0040B473
%TO_HASH, xrefs: 0040B4B0
%DATE, xrefs: 0040B4D2
%M5DATE, xrefs: 0040B50F
%TO_USER, xrefs: 0040B488
%s@%s, xrefs: 0040B461
%FROM_EMAIL, xrefs: 0040B3E9
%P5DATE, xrefs: 0040B4F2
%FROM_USER, xrefs: 0040B431

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 028E1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 028E202D
GetSystemInfo.KERNEL32(?), ref: 028E204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 028E206A
GetProcAddress.KERNEL32(00000000), ref: 028E2071
GetCurrentProcess.KERNEL32(?), ref: 028E2082
GetTickCount.KERNEL32 ref: 028E2230

Part of subcall function 028E1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 028E1E7C

Strings

flags_upd, xrefs: 028E20A5, 028E20AA, 028E20E3
localcfg, xrefs: 028E2091, 028E2098, 028E20AB, 028E20E4, 028E20F3, 028E2119, 028E2138, 028E214E, 028E2166, 028E2183, 028E219B, 028E21B7, 028E21D7
hi_id, xrefs: 028E217D, 028E2182, 028E219A
work_srv, xrefs: 028E20C5

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 3cb1a2a2befa9d2b21cd547a61c9e1e2cff4388082f3276083294b06c926fe17
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: EF510679500348AFE730AF799C88F67BAECEB56708F00091DF99BC2141D7B4A584CB66

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7686EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7686EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

net_type, xrefs: 004021DF
rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 028E3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 028E3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 028E3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 028E3095
RtlAllocateHeap.NTDLL(00000000), ref: 028E30B6
htons.WS2_32(00000035), ref: 028E30EF
inet_addr.WS2_32(?), ref: 028E30FA
gethostbyname.WS2_32(?), ref: 028E310D
HeapFree.KERNEL32(00000000), ref: 028E314D

Strings

iphlpapi.dll, xrefs: 028E3062, 028E3067, 028E3077

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: fe6b7c1e2253daf268eb4159acaa11007b0ba371e04d1a5ff9fed909feb14959
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: F231C73DA00206BBDF119BB89C48BBE7778AF06364F1441A9F91EE3290DB74DD418B54

Function 028E958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 028E95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 028E95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 028E95DC
wsprintfA.USER32 ref: 028E9635
wsprintfA.USER32 ref: 028E9673
wsprintfA.USER32 ref: 028E96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 028E9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 028E978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 028E97D8

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: d52a499908d6c722ff4f35bdb98ee029e045ad2d0d1724ac2492f895c18c9b2b
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: B0A18BBA90021CABEF21DFA4CC45FDA3BADEB06345F104026FA16D2151E7B5D584CFA5

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,771A8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 028E6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 028E67C3
htonl.WS2_32(?), ref: 028E67DF
htonl.WS2_32(?), ref: 028E67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 028E68F1
ExitProcess.KERNEL32 ref: 028E69BC

Strings

localcfg, xrefs: 028E6994
except_info, xrefs: 028E698F

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 73303b70a1d2849edf2a4a97c3651639c2883f86b1be2efc71dfda4aa36e896d
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: F4616E71A40218AFDF609FB4DC45FEA77E9FB09300F148066FA6DD2161EB7599908F14

Function 028EF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(028ECC84), ref: 028EF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 028EF5CE
closesocket.WS2_32(00000000), ref: 028EF5DC

Strings

time_cfg, xrefs: 028EF58A

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: eef8cedaa32c4043c377951ca7c411c2a849a308b9bcbfeb86339e2023e637b0
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: E43182B990011CABDB10DFA5DC85DEE7BBCEF59314F104566FA0AD3160E7708A81CBA5

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 028E2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 028E2FA1
LoadLibraryA.KERNEL32(?), ref: 028E2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 028E2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 028E3000
RtlAllocateHeap.NTDLL(00000000), ref: 028E3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 028E3032

Strings

dnsapi.dll, xrefs: 028E2F90

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 1ecba6b647f8abdf182da9002479b311280b7c13e505a04c39ee7102145d80c4
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: C621A179D00229BBCF329B94DC48AEEBBBCEF09B10F004461F906E7540D7B49A8187E4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 028E99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 028E9A18
GetThreadContext.KERNEL32(?,?), ref: 028E9A52
TerminateProcess.KERNEL32(?,00000000), ref: 028E9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 028E9A98
SetThreadContext.KERNEL32(?,00010002), ref: 028E9AB5
ResumeThread.KERNEL32(?), ref: 028E9AC2

Strings

D, xrefs: 028E9A10

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: c9ec41b2ade67ca5502a58bbb078579ca0554799ba2fa6770417042b0b6a26dd
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 3A213BB5E01229BBDF119BA1DC09EEF7BBCEF05754F404061FA1AE1050E7B58A54CBA4

Function 028E1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 028E1C18
LoadLibraryA.KERNEL32(004102C8), ref: 028E1C26
GetProcessHeap.KERNEL32 ref: 028E1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 028E1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 028E1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 028E1D02
FreeLibrary.KERNEL32(?), ref: 028E1D0B

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: c9c1fffcff74d94e154a9cf8e7a4754f3494c346b7fab8c74334e50761362ab2
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 15315E39E00209BFCF119FA4DC8C8EEBAB9EB46705B24447AE50AE2110D7B55E80DB94

Function 028E6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 028E6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 028E6D22
GetLastError.KERNEL32 ref: 028E6DA7
CloseHandle.KERNEL32(?), ref: 028E6DB5
GetLastError.KERNEL32 ref: 028E6DD6
DeleteFileA.KERNEL32(?), ref: 028E6DE7
GetLastError.KERNEL32 ref: 028E6DFD

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 57618a640335175cf7224a97212673c7bdecc9976c348a6f1f99564ae88d4f05
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 3A31E07EA00249BFCF019FA4DD48ADE7F7DEB5A310F148065E212E3250E771A6458B62

Function 028E6F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\aenzvwkq,028E7043), ref: 028E6F4E
GetProcAddress.KERNEL32(00000000), ref: 028E6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 028E6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 028E6F92

Strings

C:\Windows\SysWOW64\, xrefs: 028E6F30, 028E6F38, 028E6F65, 028E6F6C, 028E6F7A, 028E6F85, 028E6F91, 028E6FA9, 028E6FC6, 028E6FEC
\\.\pipe\aenzvwkq, xrefs: 028E6F37

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\aenzvwkq
API String ID: 1082366364-1406706810
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 6384be63ea21f87ad689a9fc9c8c216880b3f1958a660006293b1ffa09ac6a1c
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 2621262D74035039FB2253359C88FFB3E4D8B63764F1840A5F90AD5480EBD984D6826E

Function 028EAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 028EAAE5

Strings

localcfg, xrefs: 028EAD72
, xrefs: 028EABB3

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: bd8251bdc09f893b9a5eebe1649604f1cb4d663aebc7d01bc9f94a6b7e3f64c7
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 17714F7DB00308AAEF299B58DCC5FEE37699B43F19F144066F90BE2090DF6195C48756

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 028EE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 028EDF6C: GetCurrentThreadId.KERNEL32 ref: 028EDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 028EE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,028E6128), ref: 028EE950
lstrcmp.KERNEL32(?,00000008), ref: 028EE989

Strings

A, xrefs: 028EE960, 028EE965
A, xrefs: 028EE8C6, 028EE8CD, 028EE936, 028EE998
A, xrefs: 028EE9A0

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 743881cedc14541dc30f7bfbab480e5592f2d9909516d16552de3108dfc6a629
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 0E31A03DA007159BCF71AF24C8847A67BE4EB16736F00852AE56BC7550D370E884CB81

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 028E6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 028E6E19

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 4ec890531389ed2b9827086b723cf95f7571b4291eda896d6b4ad8b2b7e4dd2c
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 76213B7E10412ABFDF10ABB4EC48EDF3FADDB4A664B208465F507D1090EB71DA409674

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 028E92CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 028E92E2
wsprintfA.USER32 ref: 028E9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 028E9375
lstrlen.KERNEL32(?,?,00000000), ref: 028E9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 028E9394
CloseHandle.KERNEL32(00000000), ref: 028E939B

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: f559c86d84a7421d73ba1524187e3a8e27e10a2bfebc754b74f3b37a5f1b2682
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 94119AB97401147BEB206735DC0DFEF3A6EDBC6B10F00C065BB0AE5090EBB44A418A65

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,771B0F10,?,00000000,0040E538,?,771B0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 028EC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 028EC6B4
InterlockedIncrement.KERNEL32(028EC74B), ref: 028EC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,028EC747), ref: 028EC728
CloseHandle.KERNEL32(00000000,?,028EC747,00413588,028E8A77), ref: 028EC733

Strings

localcfg, xrefs: 028EC544

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: e33556840d804121a2f807128cc870f16b77722ba2d1fc7c7041b631f588701b
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 10514EB9A01B458FDB248F29C5D562BBBE9FB49304B50593FE18BC7AA1D774E840CB10

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,771B0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe
API String ID: 124786226-4065764218
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 028E71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 028E71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 028E7228
LocalFree.KERNEL32(?,?,?), ref: 028E7286
wsprintfA.USER32 ref: 028E729D

Strings

|, xrefs: 028E721A

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 1c2cb30a95976f0d21e5cfd967a36ee08e69b9a90a9d5056c8def77e06ed0fa4
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 9731187AA00209BBDF11DFA8DC45BDA7BACEF05314F148066F95ADB200EB75D6488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 028EB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 028EB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 028EB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 028EB548
GetTimeZoneInformation.KERNEL32(?), ref: 028EB590
wsprintfA.USER32 ref: 028EB61E

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 25f1530537e04e7d0fa01d73a3430e0f8f63cb089c662f9bb32a8779b09df4fc
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 90511FB5D0021CAACF14DFD5D8885EEBBB9BF49304F10816AF505A6150E7B84AC9CF98

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 028E62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 028E6303
LoadLibraryA.KERNEL32(?), ref: 028E632A
GetProcAddress.KERNEL32(00000000,?), ref: 028E63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 028E6405

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 0631733288a1e0ddeef6a03272c305f84d3ee5d9276ce5576473470384d772fb
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: E6414D7DA00229EFDF14CF58C884BA9B7B8FF15358F188169E86AD7290E771E940CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(771B0F18,00000000,?,771B0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,771B0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,771B0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 028E93AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 028E93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 028E93CD
CharToOemA.USER32(?,?), ref: 028E93DB
wsprintfA.USER32 ref: 028E9410

Part of subcall function 028E92CB: GetTempPathA.KERNEL32(00000400,?), ref: 028E92E2
Part of subcall function 028E92CB: wsprintfA.USER32 ref: 028E9350
Part of subcall function 028E92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 028E9375
Part of subcall function 028E92CB: lstrlen.KERNEL32(?,?,00000000), ref: 028E9389
Part of subcall function 028E92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 028E9394
Part of subcall function 028E92CB: CloseHandle.KERNEL32(00000000), ref: 028E939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 028E9448

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 967fc857c63ee5c8bd077e9d29a3f0f561625102ead1f69b9d2a2fa95e3914c2
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: E40152FA9001187BDB21A7619D49EDF3B7CDB96701F0040A1BB4AE2080DAF496C58F75

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 028E28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 028E28FA
gethostbyname.WS2_32(u6A), ref: 028E2906

Strings

time_cfg, xrefs: 028E28EB
u6A, xrefs: 028E28EC, 028E28F9, 028E2905

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: c16f7d51feb32b2618b0d47d4bd391434526ff716256e2faed6a3b0b62bb42a7
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: D4E08C386081218FDB009B28F848AD537A9AF0B230F018181F859C32A4C7349C809640

Function 028E69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 028E69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 028E6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 028E6A3A
CloseHandle.KERNEL32(000000FF), ref: 028E6BD8

Part of subcall function 028EEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,028E1DCF,?), ref: 028EEEA8
Part of subcall function 028EEE95: HeapFree.KERNEL32(00000000), ref: 028EEEAF

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 26be9e3968bc622b2e7ed04344e83377216a3f563e74984105dd3fa98dde7dd8
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 4F711679D0022DEFDF109FA4CC80AEEBBB9FB45314F10456AE516E6190E7709E92CB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 028EE2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,028EE50A,00000000,00000000,00000000,00020106,00000000,028EE50A,00000000,000000E4), ref: 028EE319
RegSetValueExA.ADVAPI32(028EE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 028EE38E
RegDeleteValueA.ADVAPI32(028EE50A,?,?,?,?,?,000000C8,004122F8), ref: 028EE3BF
RegCloseKey.ADVAPI32(028EE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,028EE50A), ref: 028EE3C8

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 420a984ac16423a8a048b8f2ee9f56cc16f22d3c181e41e7aafd048ba262ffef
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 11216F79A0021DBBDF209FA4EC89EDE7F79EF09760F048061F919E6150E3718A54DBA1

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 028E41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 028E421F
GetLastError.KERNEL32 ref: 028E4229
WaitForSingleObject.KERNEL32(?,?), ref: 028E423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 028E424D

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 4d709e8d4657076daab2aae10d588a9c2c8f1bccf9359e9aa110ace389b6bdc1
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: C9010876511109AFDF01DF90ED84BEF7BACFB09256F0080A1F91AE2050D770EA549BB6

Function 028E417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 028E41AB
GetLastError.KERNEL32 ref: 028E41B5
WaitForSingleObject.KERNEL32(?,?), ref: 028E41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 028E41D9

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 6cf7cb0b35321913318753b6ea816038b23857507ac6041419fc580ac48ee3ad
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 8B010C7A51110AAFDF01DF90ED84BEF7B6CEB19259F004062F906E2050D770DA548BB5

Function 028EE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 028EE066

Strings

A, xrefs: 028EE07F
A, xrefs: 028EE036
A, xrefs: 028EE037, 028EE03C

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: aefc7965587d1740679bb59b04fe3514368ee8a94b349ff034bbc939caacbf91
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 5AF06D3A2007169BCF30CF25D884A82B7E9FB0A335B448A2AE95AC3460D374A498CB55

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 028E8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 028E83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 028E8477

Part of subcall function 028E69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 028E69E5
Part of subcall function 028E69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 028E6A26
Part of subcall function 028E69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 028E6A3A

Part of subcall function 028EEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,028E1DCF,?), ref: 028EEEA8
Part of subcall function 028EEE95: HeapFree.KERNEL32(00000000), ref: 028EEEAF

Strings

C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 028E848C, 028E84A1

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe
API String ID: 359188348-4065764218
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 8111f746c21de0d9b5a6c5b92d315836c0079fc5f8c008d56991f5089745434e
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 214173BE900109BFDF11EBA49E80EFF776DEF06348F0484A6E906D6060F7715A548B51

Function 028EAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 028EAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 028EB00D

Part of subcall function 028EAF6F: gethostname.WS2_32(?,00000080), ref: 028EAF83
Part of subcall function 028EAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 028EAFE6

Part of subcall function 028E331C: gethostname.WS2_32(?,00000080), ref: 028E333F
Part of subcall function 028E331C: gethostbyname.WS2_32(?), ref: 028E3349

Part of subcall function 028EAA0A: inet_ntoa.WS2_32(00000000), ref: 028EAA10

Strings

%OUTLOOK_BND_, xrefs: 028EB076, 028EB07B, 028EB0BE, 028EB0DD

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 7b40eeac551daf71a168d888f8d163f536ee124665b8cfd4d54d6d96bf918dd7
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 08418E7A90020CABCF25EFA4DC45EEE3BADFB09304F144426FA29D2051EB75E6448F55

Function 028E9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 028E9536
Sleep.KERNEL32(000001F4), ref: 028E955D

Strings

, xrefs: 028E94D9

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: a173241034df20dadec73f1548cc1d66edb13b69079ca5afbea89d24dde27a58
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 4F41F3BD808389AEEF368A68D8887B63BA59F03318F1841E5D49BD71A2D7F44981C751

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 028EBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 028EB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 028EBA3A
InterlockedIncrement.KERNEL32(?), ref: 028EBA94
GetTickCount.KERNEL32 ref: 028EBB79
GetTickCount.KERNEL32 ref: 028EBB99
InterlockedIncrement.KERNEL32(?), ref: 028EBE15
closesocket.WS2_32(00000000), ref: 028EBEB4

Strings

%FROM_EMAIL, xrefs: 028EBC7D

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 4e911922cb56cedb0bf919d93488260e960869bb4ec5a2ac50845884b6297059
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 98319E79500249DFDF25DFA4DC84AEDB7A8FB46708F204066FA26D2160DB30D684CF11

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 028E709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 028E70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 028E70F4

Strings

|, xrefs: 028E70E6

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: ae8b8039ab439a83bd777cd7e1772763c24e16bcbea643b6c2a38e29cc5e0adc
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 59112A7A90025CEBDF11CBD4DC84ADEB7BCAB05305F1441A6E506E6094E7709B88EBA1

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7686EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000F.00000002.1366646890.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 028E3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 028E2F88: GetModuleHandleA.KERNEL32(?), ref: 028E2FA1
Part of subcall function 028E2F88: LoadLibraryA.KERNEL32(?), ref: 028E2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 028E31DA
HeapFree.KERNEL32(00000000), ref: 028E31E1

Memory Dump Source

Source File: 0000000F.00000002.1367922427.00000000028E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_ybyrikeu.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: fcdde366f61de399b1405a5cf41938bb2afc19d1a815d340e929854b6559a11f
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: BA516D7990024AAFCF05DF68D884AFAB775FF16305F1445A9EC9AC7210E7329A19CB90

Analysis Process: svchost.exePID: 7952, Parent PID: 7800COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1807
Total number of Limit Nodes:	18

Executed Functions

Function 02B8C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02B8CA4E
closesocket.WS2_32(?), ref: 02B8CB63
GetTempPathA.KERNEL32(00000120,?), ref: 02B8CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02B8CCB4
WriteFile.KERNEL32(02B8A4B3,?,-000000E8,?,00000000), ref: 02B8CCDC
CloseHandle.KERNEL32(02B8A4B3), ref: 02B8CCED
wsprintfA.USER32 ref: 02B8CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02B8CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 02B8CD89
CloseHandle.KERNEL32(?), ref: 02B8CD98
CloseHandle.KERNEL32(?), ref: 02B8CD9D
DeleteFileA.KERNEL32(?), ref: 02B8CDC4
CloseHandle.KERNEL32(02B8A4B3), ref: 02B8CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02B8CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02B8CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02B8D033
lstrcatA.KERNEL32(?,04300108), ref: 02B8D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 02B8D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 02B8D171
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000), ref: 02B8D195
CloseHandle.KERNEL32(00000000), ref: 02B8D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 02B8D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02B8D231
lstrcatA.KERNEL32(?,04300108,?,?,?,?,?,?,?,00000100), ref: 02B8D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02B8D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02B8D2C7
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02B8D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02B8D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02B8D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02B8D372
lstrcatA.KERNEL32(?,04300108,?,?,?,?,?,?,?,00000100), ref: 02B8D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02B8D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02B8D408
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02B8D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02B8D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02B8D45B
CreateProcessA.KERNEL32(?,02B90264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02B8D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02B8D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02B8D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02B8D513
closesocket.WS2_32(?), ref: 02B8D56C
Sleep.KERNEL32(000003E8), ref: 02B8D577
ExitProcess.KERNEL32 ref: 02B8D583
wsprintfA.USER32 ref: 02B8D81F

Part of subcall function 02B8C65C: send.WS2_32(00000000,?,00000000), ref: 02B8C74B

closesocket.WS2_32(?), ref: 02B8DAD5

Strings

@, xrefs: 02B8D754
4, xrefs: 02B8D9F7
local_time, xrefs: 02B8CACD
.sys, xrefs: 02B8D0CC
localcfg, xrefs: 02B8CA89, 02B8CA93, 02B8CAC0, 02B8CAD2, 02B8CE4F, 02B8CE6F, 02B8D8D3, 02B8D8FC
\, xrefs: 02B8D3A7
.dat, xrefs: 02B8D0D7, 02B8D138, 02B8D1AE, 02B8D1D4, 02B8D28E, 02B8D308, 02B8D3CF, 02B8D441
lid_file_upd, xrefs: 02B8CE6A
C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 02B8CC10, 02B8CCF3, 02B8D975, 02B8D98E
wtm_r, xrefs: 02B8C97F
wtm_c, xrefs: 02B8C956
flags_upd, xrefs: 02B8CE4A
wtm_w, xrefs: 02B8C96C
work_srv, xrefs: 02B8D607, 02B8D60F, 02B8D62C
\, xrefs: 02B8D39D
except_info, xrefs: 02B8D8CD, 02B8D8D2, 02B8D8FB
drivers\, xrefs: 02B8D067
srv_time, xrefs: 02B8CABB
time_cfg, xrefs: 02B8C95B, 02B8C962, 02B8C971, 02B8C984

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-525379930
Opcode ID: 981d7f8e122b191e3c55bdc2ea51d458c13317c5f135db0676f2874a6b046498
Instruction ID: d0d36fdbf11391fdb2f706f2e3692a3c07edef69ce055031446d6d5693a9d22d
Opcode Fuzzy Hash: 981d7f8e122b191e3c55bdc2ea51d458c13317c5f135db0676f2874a6b046498
Instruction Fuzzy Hash: A1B2A3B2D44219ABEB14BFA4DD45FEA7BB9EB08344F1408EAF60DA3190D7309955CF60

Function 02B89A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 02B89A7F
SetErrorMode.KERNELBASE(00000003), ref: 02B89A83
SetUnhandledExceptionFilter.KERNEL32(02B86511), ref: 02B89A8A

Part of subcall function 02B8EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 02B8EC5E
Part of subcall function 02B8EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02B8EC72
Part of subcall function 02B8EC54: GetTickCount.KERNEL32 ref: 02B8EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 02B89AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 02B89ABA
GetCommandLineA.KERNEL32 ref: 02B89AFD
lstrlenA.KERNEL32(?), ref: 02B89B99
ExitProcess.KERNEL32 ref: 02B89C06
GetTempPathA.KERNEL32(000001F4,?), ref: 02B89CAC
lstrcpyA.KERNEL32(?,00000000), ref: 02B89D7A
lstrcatA.KERNEL32(?,?), ref: 02B89D8B
lstrcatA.KERNEL32(?,02B9070C), ref: 02B89D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02B89DED
DeleteFileA.KERNEL32(00000022), ref: 02B89E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02B89E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02B89EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02B89ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 02B89F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 02B89F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02B89F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 02B89FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02B89FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02B89FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 02B8A038
lstrcatA.KERNEL32(00000022,02B90A34), ref: 02B8A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 02B8A072
lstrcatA.KERNEL32(00000022,02B90A34), ref: 02B8A08D
wsprintfA.USER32 ref: 02B8A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 02B8A0DE
lstrcatA.KERNEL32(00000022,?), ref: 02B8A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 02B8A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02B8A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 02B8A174
GetModuleFileNameA.KERNEL32(00000000), ref: 02B8A17B
GetDriveTypeA.KERNEL32(00000022), ref: 02B8A1B6
GetCommandLineA.KERNEL32 ref: 02B8A1E5

Part of subcall function 02B899D2: lstrcpyA.KERNEL32(?,?,00000100,02B922F8,00000000,?,02B89E9D,?,00000022,?,?,?,?,?,?,?), ref: 02B899DF
Part of subcall function 02B899D2: lstrcatA.KERNEL32(00000022,00000000,?,?,02B89E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 02B89A3C
Part of subcall function 02B899D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,02B89E9D,?,00000022,?,?,?), ref: 02B89A52

lstrlenA.KERNEL32(?), ref: 02B8A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 02B8A3B7
GetLastError.KERNEL32 ref: 02B8A3ED
Sleep.KERNEL32(000003E8), ref: 02B8A400
DeleteFileA.KERNELBASE(02B933D8), ref: 02B8A407
CreateThread.KERNELBASE(00000000,00000000,02B8405E,00000000,00000000,00000000), ref: 02B8A42C
WSAStartup.WS2_32(00001010,?), ref: 02B8A43A
CreateThread.KERNELBASE(00000000,00000000,02B8877E,00000000,00000000,00000000), ref: 02B8A469
Sleep.KERNELBASE(00000BB8), ref: 02B8A48A
GetTickCount.KERNEL32 ref: 02B8A49F
GetTickCount.KERNEL32 ref: 02B8A4B7
Sleep.KERNELBASE(00001A90), ref: 02B8A4C3

Strings

D, xrefs: 02B89F8E
ptcoklzf, xrefs: 02B8A389, 02B8A397
", xrefs: 02B89EDB
P, xrefs: 02B89DAA
", xrefs: 02B8A078
\, xrefs: 02B89D0C
C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 02B8A1D9
", xrefs: 02B8A189
%X%08X, xrefs: 02B8A0B0

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe$D$P$\$ptcoklzf
API String ID: 2089075347-3926062329
Opcode ID: d628e16513ca518245e9fd38091f0be4308bbfdf6b7b9931a00c8cbbb4e118db
Instruction ID: ee3b504fbd735829dfd620c9bd6322d38477e42b06750847df9adb35c65f37b4
Opcode Fuzzy Hash: d628e16513ca518245e9fd38091f0be4308bbfdf6b7b9931a00c8cbbb4e118db
Instruction Fuzzy Hash: EC5251B2D40259ABDF21BBA0CD49AEE7BBDEB04304F1448E6F60DA3141E7719A54CF61

Function 02B8199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 02B819B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,02B81E9E), ref: 02B819BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02B819E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 02B819ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 02B819F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,02B81E9E), ref: 02B81A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,02B81E9E), ref: 02B81A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,02B81E9E), ref: 02B81A36
GetAdaptersInfo.IPHLPAPI(00000000,02B81E9E,?,?,?,?,00000001,02B81E9E), ref: 02B81A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,02B81E9E,?,?,?,?,00000001,02B81E9E), ref: 02B81A5A
GetAdaptersInfo.IPHLPAPI(00000000,02B81E9E,?,?,?,?,00000001,02B81E9E), ref: 02B81A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,02B81E9E), ref: 02B81A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,02B81E9E), ref: 02B81AA4

Strings

GetBestInterface, xrefs: 02B819EF
Iphlpapi.dll, xrefs: 02B819B7
GetIfEntry, xrefs: 02B819E4
localcfg, xrefs: 02B819A3
GetAdaptersInfo, xrefs: 02B819DC
123.45.67.89, xrefs: 02B819A6

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: c1b61a0bc2bf587e1f3295cf84e355ef7d4c95ede1f62a08da087701f310353d
Instruction ID: 92565ba4c86eb61357a21a71c79e09f6d80fd5330ce53bb47008cef29dd883b8
Opcode Fuzzy Hash: c1b61a0bc2bf587e1f3295cf84e355ef7d4c95ede1f62a08da087701f310353d
Instruction Fuzzy Hash: 8931A232D11219AFDF11BFE8CD888BEBBB9EF44641B1449B9F529E3110D7304A82CB60

Function 02B87A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 02B87ABA
GetUserNameA.ADVAPI32(?,?), ref: 02B87ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,02B9070C,?,?,?), ref: 02B87B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 02B87B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 02B87B59
EqualSid.ADVAPI32(?,00000022), ref: 02B87B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B87B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B87B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02B87B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 02B87BAB
LocalFree.KERNEL32(00000000), ref: 02B87BB2
GetSecurityDescriptorDacl.ADVAPI32(?,02B87FC9,?,00000000), ref: 02B87BCE

Strings

D, xrefs: 02B87B0C
C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 02B87CE2, 02B87D0F, 02B87D23, 02B87D24

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe$D
API String ID: 2976863881-1536157608
Opcode ID: b4148892485f93a38c949e269c90bc0e49214a2eb1f08a02a18c53c9b39ec8f7
Instruction ID: 4bf76ee32219a99cd24c0f3c43d81126639d6be62e4235733c94ad6e0f768879
Opcode Fuzzy Hash: b4148892485f93a38c949e269c90bc0e49214a2eb1f08a02a18c53c9b39ec8f7
Instruction Fuzzy Hash: E7A16FB5D40219AFDF11AFA0CD88FEEBBB9FB44348F1444A9E509E3150EB318A55DB60

Function 02B87809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02B8782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02B87866
GetLengthSid.ADVAPI32(?), ref: 02B87878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02B8789A
GetSecurityDescriptorOwner.ADVAPI32(?,02B87F63,?), ref: 02B878B8
EqualSid.ADVAPI32(?,02B87F63), ref: 02B878D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B878E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B878F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02B87901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02B87910
LocalFree.KERNEL32(00000000), ref: 02B87917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02B87933
GetAce.ADVAPI32(?,00000000,?), ref: 02B87963
EqualSid.ADVAPI32(?,02B87F63), ref: 02B8798A
DeleteAce.ADVAPI32(?,00000000), ref: 02B879A3
EqualSid.ADVAPI32(?,02B87F63), ref: 02B879C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 02B87A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02B87A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02B87A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02B87A79
LocalFree.KERNEL32(00000000), ref: 02B87A87

Strings

D, xrefs: 02B8785C

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 3f6819f5b2f7002a016f87e90aa398084ce8ef593f1b09a9f50a3c4e52c48979
Instruction ID: 3f064358290bc5bee743776bb6bcbf27fdd5b18433af232d4f7aa7896940cc08
Opcode Fuzzy Hash: 3f6819f5b2f7002a016f87e90aa398084ce8ef593f1b09a9f50a3c4e52c48979
Instruction Fuzzy Hash: 16814D75D0011EABDB21EFA4CD44FEEBBB8EF08348F2445A9E619E2140DB349651DF64

Function 02B88328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,02B90750,?,?,00000000,localcfg,00000000), ref: 02B883F3
RegQueryValueExA.KERNELBASE(02B90750,?,00000000,?,02B88893,?,?,?,00000000,00000103,02B90750,?,?,00000000,localcfg,00000000), ref: 02B88414
RegSetValueExA.KERNELBASE(02B90750,?,00000000,00000004,02B88893,00000004,?,?,00000000,00000103,02B90750,?,?,00000000,localcfg,00000000), ref: 02B88441
RegCloseKey.ADVAPI32(02B90750,?,?,00000000,00000103,02B90750,?,?,00000000,localcfg,00000000), ref: 02B8844A

Strings

localcfg, xrefs: 02B88348
C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 02B885C8, 02B885D5, 02B885E5

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe$localcfg
API String ID: 237177642-1805428051
Opcode ID: ecb61b04516d4cd385837beebd883d1adf9f05dda1332da7a9b737c1624e6294
Instruction ID: c151386dcb56786e92eee4af7e1de870c74376ae409a4af7b5dbeb33bb619e14
Opcode Fuzzy Hash: ecb61b04516d4cd385837beebd883d1adf9f05dda1332da7a9b737c1624e6294
Instruction Fuzzy Hash: 47C190B2D8014DBFEB11BBA4DD85EEE7BBDEB04344F5448A5F509A6041EB308A94CF61

Function 02B81D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 02B81DC6
GetSystemInfo.KERNELBASE(?), ref: 02B81DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 02B81E03
GetProcAddress.KERNEL32(00000000), ref: 02B81E0A
GetCurrentProcess.KERNEL32(?), ref: 02B81E1B
GetTickCount.KERNEL32 ref: 02B81FC9

Part of subcall function 02B81BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 02B81C15

Strings

kernel32, xrefs: 02B81DF7
work_srv, xrefs: 02B81E5E
born_date, xrefs: 02B81EAD, 02B81ECC
start_srv, xrefs: 02B81E6C
localcfg, xrefs: 02B81E2A, 02B81E31, 02B81E44, 02B81E7D, 02B81E8C, 02B81EB2, 02B81ED1, 02B81EE7, 02B81EFF, 02B81F1C, 02B81F34, 02B81F50, 02B81F70
IsWow64Process, xrefs: 02B81DF2
net_type, xrefs: 02B81E87
hi_id, xrefs: 02B81F16, 02B81F1B, 02B81F33
lid_file_upd, xrefs: 02B81E25
loader_id, xrefs: 02B81F4B, 02B81F6B
flags_upd, xrefs: 02B81E3E, 02B81E43, 02B81E7C

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: ebbd24a6ced868e6d03e96201094542d9450fcfad4b558ea58e4defc83e7a88f
Instruction ID: e3df007ebc4bc1ed9ddd1849966e3fefe898540d7677703d8a93c3a08e3910d2
Opcode Fuzzy Hash: ebbd24a6ced868e6d03e96201094542d9450fcfad4b558ea58e4defc83e7a88f
Instruction Fuzzy Hash: CC51B1B1909344AFE720BF798C85F2BBAECEB54748F044DADF59E82242D774A504CB61

Function 02B873FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,771B0F10,00000000), ref: 02B87472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,771B0F10,00000000), ref: 02B874F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,771B0F10,00000000), ref: 02B87528
___ascii_stricmp.LIBCMT ref: 02B8764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,771B0F10,00000000), ref: 02B876E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 02B87706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 02B87717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,771B0F10,00000000), ref: 02B87745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,771B0F10,00000000), ref: 02B877EF

Part of subcall function 02B8F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02B922F8,000000C8,02B87150,?), ref: 02B8F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02B8778F
RegCloseKey.KERNELBASE(?), ref: 02B877E6

Strings

", xrefs: 02B87599

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: a774605b9b31f1a2d1bd1ec66c2d4e6b2729709647238c265220aab7d5b4c51a
Instruction ID: bb5692d22c60d57b5076c46dabe1084a8d4ec30f6436d223649340eb86afc4a4
Opcode Fuzzy Hash: a774605b9b31f1a2d1bd1ec66c2d4e6b2729709647238c265220aab7d5b4c51a
Instruction Fuzzy Hash: A9C19076940209ABEB11BBA4DC45FEEBBBAEF45314F2404E5F508A6190EF31DA44DF60

Function 02B8675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 02B8677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 02B8679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 02B867B0
SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 02B867BF
GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 02B867D3
ReadFile.KERNELBASE(000000FF,?,00000040,02B88244,00000000,?,771B0F10,00000000), ref: 02B86807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 02B8681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 02B8683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 02B8685C
ReadFile.KERNEL32(000000FF,?,00000028,02B88244,00000000,?,771B0F10,00000000), ref: 02B8688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,771B0F10,00000000), ref: 02B86906
ReadFile.KERNEL32(000000FF,?,00000000,02B88244,00000000,?,771B0F10,00000000), ref: 02B8691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,771B0F10,00000000), ref: 02B86971

Part of subcall function 02B8EC2E: GetProcessHeap.KERNEL32(00000000,02B8EA27,00000000,02B8EA27,00000000), ref: 02B8EC41
Part of subcall function 02B8EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02B8EC48

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 898e4390649cac6686d9b197fc6dddf1e83fb60dae44deb20148eb29fe6d2eec
Instruction ID: 6f211b48aaac104f767d92fbbccfb7daf7466901d6233fc17236f2cd523bad90
Opcode Fuzzy Hash: 898e4390649cac6686d9b197fc6dddf1e83fb60dae44deb20148eb29fe6d2eec
Instruction Fuzzy Hash: 89711971C0021DEFDF15AFA4CD84AEEBBB9FB08354F1045AAE519A6190E7309E51CF60

Function 02B8F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(02B8CA1D), ref: 02B8F34D
socket.WS2_32(00000002,00000001,00000000), ref: 02B8F367
closesocket.WS2_32(00000000), ref: 02B8F375

Strings

time_cfg, xrefs: 02B8F323

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 05e22a48362a95dd3c41200bb8c195db6c8ce6e348be6a991ff77ecf1e7104f3
Instruction ID: daf7a66f28ce7b289f195995ac620867882de70757e2bdf07005a3936a3d5b35
Opcode Fuzzy Hash: 05e22a48362a95dd3c41200bb8c195db6c8ce6e348be6a991ff77ecf1e7104f3
Instruction Fuzzy Hash: 13317A72940119ABDB10EFA9DC849FEBBBCFF89350F1445A6F919E3140E7309A51CBA0

Function 02B8405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02B84070
ExitProcess.KERNEL32 ref: 02B84121

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 55d1236d929c3b7a306c20e139e2104846d72376732211a5a4c7f1a656e32021
Instruction ID: 3a3f219f0085a52295a0677f38c327f27c20f485397a58b2830d15bf186a0e33
Opcode Fuzzy Hash: 55d1236d929c3b7a306c20e139e2104846d72376732211a5a4c7f1a656e32021
Instruction Fuzzy Hash: D85181B1D4021ABBEB21BBA08D45FBF7ABDEF15754F0004A5F618F6180E7358A41CBA1

Function 02B82D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,02B82F01,?,02B820FF,02B92000), ref: 02B82D3A
LoadLibraryA.KERNEL32(?), ref: 02B82D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02B82D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 02B82D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 02B82D99
HeapAlloc.KERNEL32(00000000), ref: 02B82DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 02B82DCB

Strings

dnsapi.dll, xrefs: 02B82D29
DnsQuery_A, xrefs: 02B82D5B

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: 92f167badfcc1446b2a322b3faeb08939f6faab0aa5e50d2e980a493a582d0a3
Instruction ID: 4880d4dfbf2f01d25c239abd143bf63eaa4d0b440161ca5352f4d865a08bca71
Opcode Fuzzy Hash: 92f167badfcc1446b2a322b3faeb08939f6faab0aa5e50d2e980a493a582d0a3
Instruction Fuzzy Hash: 6C218E7194022AABCB21AF64DD44AAEBFB8EF08B50F104892FD09E3100E770D981CBD0

Function 02B880C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 02B8815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,02B8A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 02B88187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,02B8A45F,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 02B881BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,771B0F10,00000000), ref: 02B88210

Part of subcall function 02B8675C: SetFileAttributesA.KERNEL32(?,00000080,?,771B0F10,00000000), ref: 02B8677E
Part of subcall function 02B8675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,771B0F10,00000000), ref: 02B8679A
Part of subcall function 02B8675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,771B0F10,00000000), ref: 02B867B0
Part of subcall function 02B8675C: SetFileAttributesA.KERNEL32(?,00000002,?,771B0F10,00000000), ref: 02B867BF
Part of subcall function 02B8675C: GetFileSize.KERNEL32(000000FF,00000000,?,771B0F10,00000000), ref: 02B867D3
Part of subcall function 02B8675C: ReadFile.KERNELBASE(000000FF,?,00000040,02B88244,00000000,?,771B0F10,00000000), ref: 02B86807
Part of subcall function 02B8675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 02B8681F
Part of subcall function 02B8675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,771B0F10,00000000), ref: 02B8683E
Part of subcall function 02B8675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,771B0F10,00000000), ref: 02B8685C

Part of subcall function 02B8EC2E: GetProcessHeap.KERNEL32(00000000,02B8EA27,00000000,02B8EA27,00000000), ref: 02B8EC41
Part of subcall function 02B8EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02B8EC48

Strings

C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe, xrefs: 02B88225, 02B8823A

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe
API String ID: 124786226-4065764218
Opcode ID: 335b0355e35394974602f790c0b5b7508766de6f686bb1ddac20946d801ac50a
Instruction ID: 79a432d39e3262b513c6ceed07c7e256313cce5e5f93956e3f6e0490914ee32a
Opcode Fuzzy Hash: 335b0355e35394974602f790c0b5b7508766de6f686bb1ddac20946d801ac50a
Instruction Fuzzy Hash: 1C414CB2D4511DBFEB11BEA4DD80EBE77BDDB04344F5448EAE949A7000EB309A94CB61

Function 02B81AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02B81AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02B81AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02B81B20

Strings

Iphlpapi.dll, xrefs: 02B81ACC
GetAdaptersAddresses, xrefs: 02B81AE3

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: c913730d7559c244ea4cef80de6e8dbe9b0f419ba3909afeb5918340d20ecf21
Instruction ID: 4a39fd233fd71aa3f44f34e97b593a1ef383582f40db0c01fe220adb82137dc6
Opcode Fuzzy Hash: c913730d7559c244ea4cef80de6e8dbe9b0f419ba3909afeb5918340d20ecf21
Instruction Fuzzy Hash: 84119672E12138AFDB15BBADDD858EDBBBAEB44B50F1444D5F00DA7110E7309A42CB94

Function 02B8E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,02B8E5F2,00000000,00020119,02B8E5F2,02B922F8), ref: 02B8E3E6
RegQueryValueExA.ADVAPI32(02B8E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 02B8E44E
RegQueryValueExA.ADVAPI32(02B8E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 02B8E482
RegQueryValueExA.ADVAPI32(02B8E5F2,?,00000000,?,80000001,?), ref: 02B8E4CF
RegCloseKey.ADVAPI32(02B8E5F2,?,?,?,?,000000C8,000000E4), ref: 02B8E520

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: f83089a00264ea4035c0a7517d9ea43bf9b2ac3002c33ff87be3706ed4260d49
Instruction ID: ab38c81308bf4d1964254e887977449c5c93eb732295958f8fa131092d6a6d21
Opcode Fuzzy Hash: f83089a00264ea4035c0a7517d9ea43bf9b2ac3002c33ff87be3706ed4260d49
Instruction Fuzzy Hash: F941F8B2D0021DAFDF11AFD4DC81DEEBBBAEB08344F5445A6FA14A3150E3319A55CB60

Function 02B8F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 02B8F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 02B8F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 02B8F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 02B8F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02B8F2FD

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: ac26d304e500303b392364d22939a4cd2793c789da7ece8b58e9c0c786f4aa0b
Instruction ID: 3e2f31d9ae2d956ca6a29b2cda00748f8c6e746003b4e6abec4b978ed98c17b8
Opcode Fuzzy Hash: ac26d304e500303b392364d22939a4cd2793c789da7ece8b58e9c0c786f4aa0b
Instruction Fuzzy Hash: 3411FBB1A40248BAEB11DE94CD41FAE7FBCEB44751F004066BB04EA1D0E6B19A44CB94

Function 02B81BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B81AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02B81AD4
Part of subcall function 02B81AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02B81AE9
Part of subcall function 02B81AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02B81B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02B81C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 02B81C51

Strings

localcfg, xrefs: 02B81BE7
hi_id, xrefs: 02B81BE5

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 40665cde358024ad3b322f9b94314f9619e144b595b91cbf389cd512747ee99b
Instruction ID: 0dad8a4c3b0ef3b0ce7e1e20a531eedee4042f8a85f47e3300ff9fdb5365d75b
Opcode Fuzzy Hash: 40665cde358024ad3b322f9b94314f9619e144b595b91cbf389cd512747ee99b
Instruction Fuzzy Hash: CD01847691511CBBEB10EAECC8C59EFBBBCE744645F1008B5D70AE7100D2309D45DA60

Function 02B81B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 02B81AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02B81AD4
Part of subcall function 02B81AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02B81AE9
Part of subcall function 02B81AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02B81B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02B81BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,02B81EFD,00000000,00000000,00000000,00000000), ref: 02B81BB8

Strings

localcfg, xrefs: 02B81B7B

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: bbf29438aaa246c6ca58fa07271d9a5d8dce918b197c7a5cba116a8cfb71b6e0
Instruction ID: 4aa8349ee476e008f8c1af727a706b276ef685248b51ac0da8084475937382f2
Opcode Fuzzy Hash: bbf29438aaa246c6ca58fa07271d9a5d8dce918b197c7a5cba116a8cfb71b6e0
Instruction Fuzzy Hash: F2014FB7D0510CBFE701ABE9C8819EFFBBDEB48654F150561EB15E7140D5705E058AA0

Function 02B82684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 02B82693
gethostbyname.WS2_32(00000001), ref: 02B8269F

Strings

time_cfg, xrefs: 02B82684

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 3e2725fafcc25fdfeb9cc16dd5655e7ba59ef12b63593ae98fb5d7d974abd4a0
Instruction ID: 674ea08e3408de56dc314749d28b9fa75856f4cf33698b557b763891bd3cad14
Opcode Fuzzy Hash: 3e2725fafcc25fdfeb9cc16dd5655e7ba59ef12b63593ae98fb5d7d974abd4a0
Instruction Fuzzy Hash: DAE01730A145619FDB50AB28F844BEA7BE5EF4A270F0589C5F898D72A0D730EC81DB94

Function 02B8E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02B8DD05: GetTickCount.KERNEL32 ref: 02B8DD0F
Part of subcall function 02B8DD05: InterlockedExchange.KERNEL32(02B936B4,00000001), ref: 02B8DD44
Part of subcall function 02B8DD05: GetCurrentThreadId.KERNEL32 ref: 02B8DD53

GetFileSize.KERNEL32(00000000,00000000,?,771B0F10,?,00000000,?,02B8A445), ref: 02B8E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,771B0F10,?,00000000,?,02B8A445), ref: 02B8E583
CloseHandle.KERNEL32(00000000,?,771B0F10,?,00000000,?,02B8A445), ref: 02B8E5B2

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 96b4037c69d1e0128c6bea033df7c3077d5821de51f1cd2a40820ab2cbde45d7
Instruction ID: 3dcf231b63bc03205aa10b69ca1444c03435a865d384f5b4c8b1f21fc0506bc8
Opcode Fuzzy Hash: 96b4037c69d1e0128c6bea033df7c3077d5821de51f1cd2a40820ab2cbde45d7
Instruction Fuzzy Hash: 7521E7F29803017AF6217A359D46F9B3A9DDB55750F1008E4FE0EB11D3EA51D910CAF1

Function 02B8877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 02B888A5

Part of subcall function 02B8F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02B8E342,00000000,7686EA50,80000001,00000000,02B8E513,?,00000000,00000000,?,000000E4), ref: 02B8F089
Part of subcall function 02B8F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02B8E342,00000000,7686EA50,80000001,00000000,02B8E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02B8F093

Strings

localcfg, xrefs: 02B887CA, 02B887CF, 02B887FB, 02B88835, 02B88861
rresolv, xrefs: 02B887F6, 02B8885C

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 246b244c8fb959d5f79dee265e81d15a7e04bbdd12ab92e9b7c5100c377e1537
Instruction ID: 9d48e9f38d4c0eac7839446d788f4ccd5199a98550bd753374f3a7f139641a16
Opcode Fuzzy Hash: 246b244c8fb959d5f79dee265e81d15a7e04bbdd12ab92e9b7c5100c377e1537
Instruction Fuzzy Hash: 8C210932D883047FF314FB64AD45F7A3A9AEB00764FD44899FD0C860C1EBA19580C9B2

Function 02B84000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,02B922F8,02B842B6,00000000,00000001,02B922F8,00000000,?,02B898FD), ref: 02B84021
GetLastError.KERNEL32(?,02B898FD,00000001,00000100,02B922F8,02B8A3C7), ref: 02B8402C
Sleep.KERNEL32(000001F4,?,02B898FD,00000001,00000100,02B922F8,02B8A3C7), ref: 02B84046

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 249a3ab932c207a612e6cbcf58b525e61b6a333de6af0e45c3a4b9cd8ce30c85
Instruction ID: 1a70ad12dcc51680c820193104eaecdaeda9964a22269dda85bded012be9b0c1
Opcode Fuzzy Hash: 249a3ab932c207a612e6cbcf58b525e61b6a333de6af0e45c3a4b9cd8ce30c85
Instruction Fuzzy Hash: AFF0A7326402066BD7312A34AC49B1B3275EB81728F264F64F3B9F20D0C7308481DB14

Function 02B8DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02B8DC19,?,00000104), ref: 02B8DB7F
lstrcpyA.KERNEL32(?,02B928F8), ref: 02B8DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 02B8DBC2

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: 3e40b77140b9cc4872b760435e31e2c2ad69cdc84274ce52c9c37d4daadb272d
Instruction ID: 5fa61cdcdf5db0972b7ae92c3b55c8c0bd255ca4283d86984845161cdf3a0125
Opcode Fuzzy Hash: 3e40b77140b9cc4872b760435e31e2c2ad69cdc84274ce52c9c37d4daadb272d
Instruction Fuzzy Hash: 60F09A7054020AABEF20AF64DD89FE93B69AB10348F2049A4FB95A50D0D7F2D595CB20

Function 02B8EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 02B8EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02B8EC72
GetTickCount.KERNEL32 ref: 02B8EC78

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 28db28ef3db96546fd27de1318a21d1c7f503f55fba421a391fe3ca119f6bbdb
Instruction ID: 1ba252498277acd327f0438f95a73259f6f5ce05476517b7256f22d1f200b0a6
Opcode Fuzzy Hash: 28db28ef3db96546fd27de1318a21d1c7f503f55fba421a391fe3ca119f6bbdb
Instruction Fuzzy Hash: 35E09AF5C50108BFE701ABB0DD4AE6B77BCEB08354F510A50F911D6090DA709A148B60

Function 02B830B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02B830D8
gethostbyname.WS2_32(?), ref: 02B830E2

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 29f1662b58b4b1548846affcdadd25fcc180e99d3590b6e9481f2657a919cc01
Instruction ID: 184ba2eed8863257d95cbc4420e215551126345f086984f2e7d59fa5c0de079d
Opcode Fuzzy Hash: 29f1662b58b4b1548846affcdadd25fcc180e99d3590b6e9481f2657a919cc01
Instruction Fuzzy Hash: 1CE06572D001199BCB10ABA8EC85F9A77ECFB04248F084461F945E3240EA34E504C790

Function 02B8EC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02B8EBA0: GetProcessHeap.KERNEL32(00000000,00000000,02B8EC0A,00000000,80000001,?,02B8DB55,7FFF0001), ref: 02B8EBAD
Part of subcall function 02B8EBA0: HeapSize.KERNEL32(00000000,?,02B8DB55,7FFF0001), ref: 02B8EBB4

GetProcessHeap.KERNEL32(00000000,02B8EA27,00000000,02B8EA27,00000000), ref: 02B8EC41
RtlFreeHeap.NTDLL(00000000), ref: 02B8EC48

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: d731c80e791a61d3163f7c851769fcb46588930171c15d1be4cefa0031d9f114
Instruction ID: 6d06869274b5e011bd18341b7ac0096cddb80be9086897fb4c2fe78efd947946
Opcode Fuzzy Hash: d731c80e791a61d3163f7c851769fcb46588930171c15d1be4cefa0031d9f114
Instruction Fuzzy Hash: 95C01232C462306BC5513A60B90CF9B6B58DF46A51F090C49F50967044876098808EE1

Function 02B8EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,02B8EBFE,7FFF0001,?,02B8DB55,7FFF0001), ref: 02B8EBD3
RtlAllocateHeap.NTDLL(00000000,?,02B8DB55,7FFF0001), ref: 02B8EBDA

Part of subcall function 02B8EB74: GetProcessHeap.KERNEL32(00000000,00000000,02B8EC28,00000000,?,02B8DB55,7FFF0001), ref: 02B8EB81
Part of subcall function 02B8EB74: HeapSize.KERNEL32(00000000,?,02B8DB55,7FFF0001), ref: 02B8EB88

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: 68ff16f166cec9b2cbad00f62b4ca5889855bf11d0849520058a916751ea4c07
Instruction ID: 21359e0af8a597a3b20a296a7f03edd860ce13c8ab48eb1e50b8ee6cb1abbd46
Opcode Fuzzy Hash: 68ff16f166cec9b2cbad00f62b4ca5889855bf11d0849520058a916751ea4c07
Instruction Fuzzy Hash: 03C01232A48230ABC60137B4BD08B9A2A98AF08AA2F040844F609C2164CA2088908AA6

Function 02B8F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,02B8CA44), ref: 02B8F476

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: f9053f921c13babb46386d350d5a87bb888821b1f15046108c0e804b85e9f3c5
Instruction ID: e5a9b27b5a1394141b7de238647a2a76fc8dc16757cb148859f222319a947239
Opcode Fuzzy Hash: f9053f921c13babb46386d350d5a87bb888821b1f15046108c0e804b85e9f3c5
Instruction Fuzzy Hash: 16F01C7320155EAB9F11AE9ADC84CBB3BAEFB892507480562FA18D7110D631E821CBA0

Function 02B81978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 02B81992

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: c42a406d5c420abdca3b0eaa86fb2f4cfa5a22c9f5af8f47ae6dc5d60725b5c0
Instruction ID: f26d61221d704ef2352d1c4f7e6be21911099b9d395b571a9825d19844c5b4aa
Opcode Fuzzy Hash: c42a406d5c420abdca3b0eaa86fb2f4cfa5a22c9f5af8f47ae6dc5d60725b5c0
Instruction Fuzzy Hash: D2D012265496326A52113759B80447FBB9CDF456A2751985BFD8CC1150D734C842C795

Function 02B8DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 02B8DDB5

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 05fbfbfb548ec7848902e7ea0e84b6a13d75b9f0d4b0239637a6cbcdde810f97
Instruction ID: 160fedf5b5f7af3451a3253b8bb7819bdfdc930cb5accc6ed91e78c0e63807ce
Opcode Fuzzy Hash: 05fbfbfb548ec7848902e7ea0e84b6a13d75b9f0d4b0239637a6cbcdde810f97
Instruction Fuzzy Hash: D7F058326002039BCB20AE349984656B7E8EB86329F5449ABE55D93280EB30D859CB11

Non-executed Functions

Function 02B8637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02B89816,EntryPoint), ref: 02B8638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,02B89816,EntryPoint), ref: 02B863A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02B863CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02B863EB

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: a20fea9954a0d93bc96de928163e21d3c6c6fe37051035663762651d73a58f4c
Instruction ID: 6dc3c5aa26b8e3d6625ee9e3f47e86dfb869fc9bcb9e91455a9e89c7a06f0660
Opcode Fuzzy Hash: a20fea9954a0d93bc96de928163e21d3c6c6fe37051035663762651d73a58f4c
Instruction Fuzzy Hash: 261191B2A00219BFDB51AE69DC49F9B3BACEB047A5F008464F918E7280D770DC10CAA0

Function 02B81000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,02B81839,02B89646), ref: 02B81012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 02B810C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 02B810E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 02B81101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 02B81121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 02B81140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 02B81160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 02B81180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 02B8119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 02B811BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 02B811DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 02B811FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 02B8121A

Strings

RtlLengthSid, xrefs: 02B81246
RtlExpandEnvironmentStrings_U, xrefs: 02B810BC
RtlAllocateAndInitializeSid, xrefs: 02B8120F
RtlSetLastWin32Error, xrefs: 02B810D6
NtSetInformationThread, xrefs: 02B81155
ntdll.dll, xrefs: 02B8100D
NtFilterToken, xrefs: 02B8122B
NtTerminateProcess, xrefs: 02B810F6
NtOpenProcessToken, xrefs: 02B811D4
NtDuplicateToken, xrefs: 02B811F3
NtQueryInformationToken, xrefs: 02B81262
RtlFreeSid, xrefs: 02B81116
NtSetInformationToken, xrefs: 02B81175
RtlNtStatusToDosError, xrefs: 02B81194
RtlInitUnicodeString, xrefs: 02B81135
NtClose, xrefs: 02B811B4

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: a9593102874dac1eff9773b264f53c2776b7b83e3c7eb72e28e6370487bd42cc
Instruction ID: 3310f4cc400ea9ece554ec32eea417bcb255266f396d9ca2a87875d8866fc967
Opcode Fuzzy Hash: a9593102874dac1eff9773b264f53c2776b7b83e3c7eb72e28e6370487bd42cc
Instruction Fuzzy Hash: EC51B8719A3602EFDB11ABACAD4475232E4E3482A4F044BE6EA2FD31E0D770C492CF51

Function 02B8B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02B8B2B3
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 02B8B2C2
FileTimeToSystemTime.KERNEL32(?,?), ref: 02B8B2D0
SystemTimeToFileTime.KERNEL32(?,?), ref: 02B8B2E1
FileTimeToSystemTime.KERNEL32(?,?), ref: 02B8B31A
GetTimeZoneInformation.KERNEL32(?), ref: 02B8B329
wsprintfA.USER32 ref: 02B8B3B7

Strings

Mar, xrefs: 02B8B264
Jul, xrefs: 02B8B280
Feb, xrefs: 02B8B25D
Sat, xrefs: 02B8B24F
Wed, xrefs: 02B8B23A
Dec, xrefs: 02B8B2A3
Nov, xrefs: 02B8B29C
Sun, xrefs: 02B8B225
Mon, xrefs: 02B8B22C
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 02B8B3AF
Jan, xrefs: 02B8B256
Oct, xrefs: 02B8B295
May, xrefs: 02B8B272
Apr, xrefs: 02B8B26B
Thu, xrefs: 02B8B241
Aug, xrefs: 02B8B287
Fri, xrefs: 02B8B248
Tue, xrefs: 02B8B233
Jun, xrefs: 02B8B279
Sep, xrefs: 02B8B28E

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: a4ca3192ded28ad2a4a833d2653ec87ab1ab5a8c569ab8159af77c87b0e310f3
Instruction ID: 06415bdfd7f4b13c92b4fbfd61611e9ef7e8dde1fff5f9ee94bf85a3e113025a
Opcode Fuzzy Hash: a4ca3192ded28ad2a4a833d2653ec87ab1ab5a8c569ab8159af77c87b0e310f3
Instruction Fuzzy Hash: 61510EB2E0021DAACF14EFD5D9849EFBBB9FF48309F1048E9E515B6150D3344A89CB54

Function 02B86511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B8654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 02B8655C
htonl.WS2_32(?), ref: 02B86578
htonl.WS2_32(?), ref: 02B86587
wsprintfA.USER32 ref: 02B8659B
wsprintfA.USER32 ref: 02B865DC
wsprintfA.USER32 ref: 02B86671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02B8668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 02B86696
wsprintfA.USER32 ref: 02B866B0
wsprintfA.USER32 ref: 02B866E7
wsprintfA.USER32 ref: 02B866FF
wsprintfA.USER32 ref: 02B8671F
ExitProcess.KERNEL32 ref: 02B86755

Strings

%d=%p, xrefs: 02B866F9
Jan 13 2018, xrefs: 02B8653A
plgs:, xrefs: 02B866AA
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 02B865D6
localcfg, xrefs: 02B8672D
except_info, xrefs: 02B86728
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 02B8666B
ver=%d date=%s %sc=%08x a=%p, xrefs: 02B86547
va=%08X%08X uef=%p, xrefs: 02B86595
12:08:32, xrefs: 02B86535

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: dd7ecd7b0c187566a85ca7aa7b5cec0ac15da25a8835c5258d10ec9f3a3ccee8
Instruction ID: 605341d07cdbbf2225f911ddbf4c0edc8c6a18544666fb71137caf051c237790
Opcode Fuzzy Hash: dd7ecd7b0c187566a85ca7aa7b5cec0ac15da25a8835c5258d10ec9f3a3ccee8
Instruction Fuzzy Hash: 0F611972950208AFEF60AFA4DC45FEA77E9FF08300F1484A9F96DD2161EA719950CF50

Function 02B8A7C1 Relevance: 40.5, APIs: 8, Strings: 15, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B8A7FB
lstrlenA.KERNEL32(?), ref: 02B8A87E
send.WS2_32(?,?,00000000,00000000), ref: 02B8A893
wsprintfA.USER32 ref: 02B8A8AF
send.WS2_32(?,.,00000005,00000000), ref: 02B8A8D2
wsprintfA.USER32 ref: 02B8A8E2
recv.WS2_32(?,?,000003F6,00000000), ref: 02B8A97C
wsprintfA.USER32 ref: 02B8A9B9

Strings

mail from:<%s>, xrefs: 02B8A848
, xrefs: 02B8A94C
localcfg, xrefs: 02B8AB0B
rcpt to:<%s>, xrefs: 02B8A855
ehlo %s, xrefs: 02B8A7F5
Too small respons, xrefs: 02B8A9C9
AUTH LOGIN, xrefs: 02B8A80C
quit, xrefs: 02B8A86C
Incorrect respons, xrefs: 02B8AB39
ESMTP, xrefs: 02B8AA38
Too big smtp respons (%d bytes), xrefs: 02B8A9B1
Error sending command (sent = %d/%d), xrefs: 02B8A8A7, 02B8A8DA
data, xrefs: 02B8A85E
helo %s, xrefs: 02B8A803
., xrefs: 02B8A8CA

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$ $AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-4264063882
Opcode ID: bb7579b256d74b058b8605a2c3e27ebe0da61e5e8e9f83c15af8fa8bc8104ad9
Instruction ID: 6ab301393eb6d248a434fc3fecd28533a89dd9671687dc8f2d671d92b48eab5e
Opcode Fuzzy Hash: bb7579b256d74b058b8605a2c3e27ebe0da61e5e8e9f83c15af8fa8bc8104ad9
Instruction Fuzzy Hash: BDA13D72944315ABEF20BA54DC85FBE7B6AFB00708F1408E7F90EA7090EB71A954CB55

Function 02B81280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02B8139A
lstrlenW.KERNEL32(-00000003), ref: 02B81571

Strings

%systemroot%\system32\cmd.exe, xrefs: 02B81316
useless, xrefs: 02B8161E
uac, xrefs: 02B81628
D, xrefs: 02B815C6
wusa.exe, xrefs: 02B81388
@, xrefs: 02B81380
<, xrefs: 02B81378
, xrefs: 02B81462

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: e561550d906401daa488306bf7fa042f621cb04b3ca8302ed18edd4be29effad
Instruction ID: 071de74090f6340fbedf7316d9c1464e167d2be0f003fbede931442c42a32f12
Opcode Fuzzy Hash: e561550d906401daa488306bf7fa042f621cb04b3ca8302ed18edd4be29effad
Instruction Fuzzy Hash: 88F19BB55193419FD320EF68C888BAAB7E5FB88344F004DADFA9E87280D774D845CB52

Function 02B82A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,771AF380), ref: 02B82A83
HeapAlloc.KERNEL32(00000000,?,771AF380), ref: 02B82A86
socket.WS2_32(00000002,00000002,00000011), ref: 02B82AA0
htons.WS2_32(00000000), ref: 02B82ADB
select.WS2_32 ref: 02B82B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 02B82B4A
htons.WS2_32(?), ref: 02B82B71
htons.WS2_32(?), ref: 02B82B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02B82BFB

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: adfe9937f9e861e8204a99865665dac5c5fab05ea46afbe81fec3226cd066112
Instruction ID: e3ee372a836ca71d26e17e3906f463c2d8d621d9f31a47747b338a5db8f15124
Opcode Fuzzy Hash: adfe9937f9e861e8204a99865665dac5c5fab05ea46afbe81fec3226cd066112
Instruction Fuzzy Hash: 2961AE719043459FD720BF65DD08B7ABBE8EB48785F000849FE8997140D7B0D880CFA2

Function 02B8704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,771B0F10,?,771B0F10,00000000), ref: 02B870C2
RegEnumValueA.ADVAPI32(771B0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,771B0F10,00000000), ref: 02B8719E
RegCloseKey.ADVAPI32(771B0F10,?,771B0F10,00000000), ref: 02B871B2
RegCloseKey.ADVAPI32(771B0F10), ref: 02B87208
RegCloseKey.ADVAPI32(771B0F10), ref: 02B87291
___ascii_stricmp.LIBCMT ref: 02B872C2
RegCloseKey.ADVAPI32(771B0F10), ref: 02B872D0
RegCloseKey.ADVAPI32(771B0F10), ref: 02B87314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02B8738D
RegCloseKey.ADVAPI32(771B0F10), ref: 02B873D8

Part of subcall function 02B8F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02B922F8,000000C8,02B87150,?), ref: 02B8F1AD

Strings

", xrefs: 02B87227
, xrefs: 02B87194

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 4dc03420bb0e57684a92d892059bb0618f486004e6ad0eeb76ae2956233cd785
Instruction ID: 02470a2e507750eeafe6603a770d5bc0651d581339539a48833f37ec7db46fdf
Opcode Fuzzy Hash: 4dc03420bb0e57684a92d892059bb0618f486004e6ad0eeb76ae2956233cd785
Instruction Fuzzy Hash: 8BB19376944209ABDF15FFA0DC45BEEB7B9EF05304F2004A6F509E2090EB719A84DB61

Function 02B8AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02B8AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 02B8ADA6

Part of subcall function 02B8AD08: gethostname.WS2_32(?,00000080), ref: 02B8AD1C
Part of subcall function 02B8AD08: lstrlenA.KERNEL32(?), ref: 02B8AD60
Part of subcall function 02B8AD08: lstrlenA.KERNEL32(?), ref: 02B8AD69
Part of subcall function 02B8AD08: lstrcpyA.KERNEL32(?,LocalHost), ref: 02B8AD7F

Part of subcall function 02B830B5: gethostname.WS2_32(?,00000080), ref: 02B830D8
Part of subcall function 02B830B5: gethostbyname.WS2_32(?), ref: 02B830E2

wsprintfA.USER32 ref: 02B8AEA5

Part of subcall function 02B8A7A3: inet_ntoa.WS2_32(00000000), ref: 02B8A7A9

wsprintfA.USER32 ref: 02B8AE4F
wsprintfA.USER32 ref: 02B8AE5E

Part of subcall function 02B8EF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 02B8EF92
Part of subcall function 02B8EF7C: lstrlenA.KERNEL32(?), ref: 02B8EF99
Part of subcall function 02B8EF7C: lstrlenA.KERNEL32(00000000), ref: 02B8EFA0

Strings

%OUTLOOK_BND_, xrefs: 02B8AE0F, 02B8AE14, 02B8AE57, 02B8AE76
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 02B8AE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 02B8AE49
127.0.0.1, xrefs: 02B8ADEB
%s%d, xrefs: 02B8AE58
%OUTLOOK_HST, xrefs: 02B8AEC5
%OUTLOOK_MID, xrefs: 02B8AEAE

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 7f424982ec7831cd355bbab427a4e2641dd5e3861310d8a671ae1d4c0a00c72e
Instruction ID: 48658644a074344dab7af41fecd422ff44b8365995c7f0dd3dda26beeee30e55
Opcode Fuzzy Hash: 7f424982ec7831cd355bbab427a4e2641dd5e3861310d8a671ae1d4c0a00c72e
Instruction Fuzzy Hash: 5641EEB290025CABEF25BFA0DC45EEE3BADFB08344F1448A6F91992151EA71D554CF50

Function 02B82DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,771B23A0,?,000DBBA0,?,00000000,02B82F0F,?,02B820FF,02B92000), ref: 02B82E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,02B82F0F,?,02B820FF,02B92000), ref: 02B82E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 02B82E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,02B82F0F,?,02B820FF,02B92000), ref: 02B82E4C
HeapAlloc.KERNEL32(00000000,?,00000000,02B82F0F,?,02B820FF,02B92000), ref: 02B82E4F
htons.WS2_32(00000035), ref: 02B82E88
inet_addr.WS2_32(?), ref: 02B82E93
gethostbyname.WS2_32(?), ref: 02B82EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,02B82F0F,?,02B820FF,02B92000), ref: 02B82EE3
HeapFree.KERNEL32(00000000,?,00000000,02B82F0F,?,02B820FF,02B92000), ref: 02B82EE6

Strings

GetNetworkParams, xrefs: 02B82E28
iphlpapi.dll, xrefs: 02B82DFB, 02B82E00, 02B82E10

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: c632650ea7879f0c12aa042ca3082cf407b29297454e76926c98858cbb5bd7ec
Instruction ID: 3873e5a27c2f21fc3c27f6c91a469f74dcd9e143b15a505249fb1035be4c04a9
Opcode Fuzzy Hash: c632650ea7879f0c12aa042ca3082cf407b29297454e76926c98858cbb5bd7ec
Instruction Fuzzy Hash: 3631B133E4024AABDB10BBB89848B6E7BB8EF04766F140995FD1CE7290DB30D551CB58

Function 02B89326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,02B89DD7,?,00000022,?,?,00000000,00000001), ref: 02B89340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,02B89DD7,?,00000022,?,?,00000000,00000001), ref: 02B8936E
GetModuleFileNameA.KERNEL32(00000000,?,02B89DD7,?,00000022,?,?,00000000,00000001), ref: 02B89375
wsprintfA.USER32 ref: 02B893CE
wsprintfA.USER32 ref: 02B8940C
wsprintfA.USER32 ref: 02B8948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02B894F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02B89526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02B89571

Strings

runas, xrefs: 02B89674

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 67d4ff2ce09f9788552c25a43940e7082af844fec85d8d275671f84def3c3a8c
Instruction ID: 7fadaee1e314da9dfc3441d2310a0d93ff968b11abd7ab850159adcd5c500960
Opcode Fuzzy Hash: 67d4ff2ce09f9788552c25a43940e7082af844fec85d8d275671f84def3c3a8c
Instruction Fuzzy Hash: 55A18FB2940648EFEF21AFA0CC45FEE3BADEB44740F1004A6FA0992251E771D594CFA0

Function 02B82011 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B82078
GetTickCount.KERNEL32 ref: 02B820D4
GetTickCount.KERNEL32 ref: 02B820DB
GetTickCount.KERNEL32 ref: 02B8212B
GetTickCount.KERNEL32 ref: 02B82132
GetTickCount.KERNEL32 ref: 02B82142

Part of subcall function 02B8F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02B8E342,00000000,7686EA50,80000001,00000000,02B8E513,?,00000000,00000000,?,000000E4), ref: 02B8F089
Part of subcall function 02B8F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02B8E342,00000000,7686EA50,80000001,00000000,02B8E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02B8F093

Part of subcall function 02B8E854: lstrcpyA.KERNEL32(00000001,?,?,02B8D8DF,00000001,localcfg,except_info,00100000,02B90264), ref: 02B8E88B
Part of subcall function 02B8E854: lstrlenA.KERNEL32(00000001,?,02B8D8DF,00000001,localcfg,except_info,00100000,02B90264), ref: 02B8E899

Part of subcall function 02B81C5F: wsprintfA.USER32 ref: 02B81CE1

Strings

iq_, xrefs: 02B820DD, 02B8212D
localcfg, xrefs: 02B82070, 02B82160, 02B82186, 02B82194, 02B821E4
net_type, xrefs: 02B821DF
rbl_ip, xrefs: 02B8218F
rbl_bl, xrefs: 02B82181

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: iq_$localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-930786573
Opcode ID: 7207a5137fab5147c09f07594764ca5353f57443a7bc969280abe8ea9d73d7c4
Instruction ID: d69611bd64593a5ca27a9fd232cfb90f9193f8d6d9ad6ed227d8abc08d96b95e
Opcode Fuzzy Hash: 7207a5137fab5147c09f07594764ca5353f57443a7bc969280abe8ea9d73d7c4
Instruction Fuzzy Hash: 925126B1D853866EE728FF34EE45B663BD5EB00354F20089DEE8DC7190DBB49498CA11

Function 02B8B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B8B467

Part of subcall function 02B8EF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 02B8EF92
Part of subcall function 02B8EF7C: lstrlenA.KERNEL32(?), ref: 02B8EF99
Part of subcall function 02B8EF7C: lstrlenA.KERNEL32(00000000), ref: 02B8EFA0

Strings

%P5DATE, xrefs: 02B8B4F2
%FROM_DOMAIN, xrefs: 02B8B41E
%s@%s, xrefs: 02B8B461
%FROM_USER, xrefs: 02B8B431
%TO_DOMAIN, xrefs: 02B8B44B
%TO_EMAIL, xrefs: 02B8B473
%TO_HASH, xrefs: 02B8B4B0
%M5DATE, xrefs: 02B8B50F
%DATE, xrefs: 02B8B4D2
%TO_USER, xrefs: 02B8B488
%FROM_EMAIL, xrefs: 02B8B3E9

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: b7dc2c17e8b10429fe9f333cc7a6570860cb15b0a7d41d7cce999f6dad9bb5b9
Instruction ID: 0462936c5976a0d20d18b8ef31ba2df7ccf4b964a0ae7d82ab2b741d35641b9a
Opcode Fuzzy Hash: b7dc2c17e8b10429fe9f333cc7a6570860cb15b0a7d41d7cce999f6dad9bb5b9
Instruction Fuzzy Hash: FF413BB254011DBEEF01BAA4CCC1DBF7B7DEF49648F1404A5FA09B2010DB75AA58CBA1

Function 02B8C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02B8A4C7: GetTickCount.KERNEL32 ref: 02B8A4D1
Part of subcall function 02B8A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 02B8A4FA

GetTickCount.KERNEL32 ref: 02B8C31F
GetTickCount.KERNEL32 ref: 02B8C32B
GetTickCount.KERNEL32 ref: 02B8C363
GetTickCount.KERNEL32 ref: 02B8C378
GetTickCount.KERNEL32 ref: 02B8C44D
InterlockedIncrement.KERNEL32(02B8C4E4), ref: 02B8C4AE
CreateThread.KERNEL32(00000000,00000000,02B8B535,00000000,?,02B8C4E0), ref: 02B8C4C1
CloseHandle.KERNEL32(00000000,?,02B8C4E0,02B93588,02B88810), ref: 02B8C4CC

Strings

localcfg, xrefs: 02B8C2DD

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 6e72787a3bf405879e2a89e426199f14407eb19c2c2dd94ff86b857b7e9de70a
Instruction ID: 71a4d92cae44980f7b4de927cad29148d6afa357a2c69f6425312d43bf91e82d
Opcode Fuzzy Hash: 6e72787a3bf405879e2a89e426199f14407eb19c2c2dd94ff86b857b7e9de70a
Instruction Fuzzy Hash: E2515DB1900B418FD728AF69C5C452ABBE9FB48304B549D7ED18BC7A90D774F845CB24

Function 02B8BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02B8BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02B8BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02B8BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02B8BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02B8BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02B8BF94

Strings

smtp_herr, xrefs: 02B8BE46, 02B8BF62
smtp_ban, xrefs: 02B8BE55, 02B8BF77
smtp_retr, xrefs: 02B8BE61, 02B8BF8C

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: ff6f494e53e63a6b521d798c3a3e9963f11e94b74dc2c681482c79f74ff685af
Instruction ID: 2589a09a91bbff08115f29f29481333f310e655743e99bc0065595297c55ac25
Opcode Fuzzy Hash: ff6f494e53e63a6b521d798c3a3e9963f11e94b74dc2c681482c79f74ff685af
Instruction Fuzzy Hash: F4515E72A0461AEFDF11AE78C980B5EBBA9EF0534DF0444E9E949DB211D730E945CF90

Function 02B86A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,771A8A60,?,?,?,?,02B89A60,?,?,02B89E9D), ref: 02B86A7D
GetDiskFreeSpaceA.KERNEL32(02B89E9D,02B89A60,?,?,?,02B922F8,?,?,?,02B89A60,?,?,02B89E9D), ref: 02B86ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,02B89A60,?,?,02B89E9D), ref: 02B86B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02B89A60,?,?,02B89E9D), ref: 02B86B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02B89A60,?,?,02B89E9D), ref: 02B86B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,02B89A60,?,?,02B89E9D), ref: 02B86B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02B89A60,?,?,02B89E9D), ref: 02B86B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,02B89A60,?,?,02B89E9D), ref: 02B86B80
GetLastError.KERNEL32(?,?,?,02B89A60,?,?,02B89E9D,?,?,?,?,?,02B89E9D,?,00000022,?), ref: 02B86B96

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 76220c365b44d86b73e54f957434a2c19b1dbce00647ad1c87376cd9089bd35a
Instruction ID: 309acf9819d27c3593682060b046ef025032984e47b034d4011684cee476b210
Opcode Fuzzy Hash: 76220c365b44d86b73e54f957434a2c19b1dbce00647ad1c87376cd9089bd35a
Instruction Fuzzy Hash: 4E31F2B2D0014DBFCB01BFA48A85ADE7B7DEF48344F1448A6E619A3200D73095A4CF61

Function 02B86F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,02B8D7C3), ref: 02B86F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,02B8D7C3), ref: 02B86FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 02B86FE8
LocalFree.KERNEL32(00000120), ref: 02B8701F
wsprintfA.USER32 ref: 02B87036

Strings

/%d, xrefs: 02B87030
|, xrefs: 02B86FB3

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 0b98f37957213d93fb05c3ad41a7be5cbbdd9cd70679ba9cd21a2a4f212e1280
Instruction ID: 9a7dac60a60b4881b42085e2dd1a536c1c0f3f0248c21bac5695844efe86ba38
Opcode Fuzzy Hash: 0b98f37957213d93fb05c3ad41a7be5cbbdd9cd70679ba9cd21a2a4f212e1280
Instruction Fuzzy Hash: F6312976900219AFDB01EFA8D848ADA7BBCEF04354F1484A6F85DDB101EB35E608CB94

Function 02B86CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,02B922F8,000000E4,02B86DDC,000000C8), ref: 02B86CE7
GetProcAddress.KERNEL32(00000000), ref: 02B86CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02B86D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02B86D2B

Strings

kernel32, xrefs: 02B86CE2
C:\Windows\SysWOW64\, xrefs: 02B86CC9, 02B86CD1, 02B86CFE, 02B86D05, 02B86D13, 02B86D1E, 02B86D2A, 02B86D42, 02B86D5F, 02B86D85
GetSystemWow64DirectoryA, xrefs: 02B86CDD

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 183ebc6abba769727aa36318b455f4ec048fbd1d3d39ba8378a621a458553043
Instruction ID: 62ed1c0912e686918afa10f86767811e5e89fdf49352d21c218f52b99baf090a
Opcode Fuzzy Hash: 183ebc6abba769727aa36318b455f4ec048fbd1d3d39ba8378a621a458553043
Instruction Fuzzy Hash: BD212662EC565479FB2576225CC9F673F8DCB03784F0808D4FC0C97081E7948485C7A5

Function 02B8977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02B89947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,02B922F8), ref: 02B897B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,02B922F8), ref: 02B897EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,02B922F8), ref: 02B897F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,02B922F8), ref: 02B89831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,02B922F8), ref: 02B8984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,02B922F8), ref: 02B8985B

Strings

D, xrefs: 02B897A9

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 8347ac8177a40222afd5469d295e3c0be627fa0d9cb5c59fd5d65bec838b5f71
Instruction ID: 1cf4e3e6cd7ab37cddb91e32cc32df4bd8d3714d73d5c32920367b07feb54b29
Opcode Fuzzy Hash: 8347ac8177a40222afd5469d295e3c0be627fa0d9cb5c59fd5d65bec838b5f71
Instruction Fuzzy Hash: 97210C71D41129ABDF21AFA1DC49FEF7B7CEF09694F0048A1FA19E2150EB309654CEA0

Function 02B8E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02B8DD05: GetTickCount.KERNEL32 ref: 02B8DD0F
Part of subcall function 02B8DD05: InterlockedExchange.KERNEL32(02B936B4,00000001), ref: 02B8DD44
Part of subcall function 02B8DD05: GetCurrentThreadId.KERNEL32 ref: 02B8DD53

Part of subcall function 02B8DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 02B8DDB5

lstrcpynA.KERNEL32(?,02B81E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,02B8EAAA,?,?), ref: 02B8E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,02B8EAAA,?,?,00000001,?,02B81E84,?), ref: 02B8E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,02B8EAAA,?,?,00000001,?,02B81E84,?,0000000A), ref: 02B8E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,02B8EAAA,?,?,00000001,?,02B81E84,?), ref: 02B8E94F

Strings

localcfg, xrefs: 02B8E8AB
flags_upd, xrefs: 02B8E8A7

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 772ef09069f1e17e03f2ec9ceaff7fc0d459c1a336c06663d05ad5f85e80f447
Instruction ID: 4e3d504a2fffbab0c4c432216e02efd30df06cc19792e800381c43baee345532
Opcode Fuzzy Hash: 772ef09069f1e17e03f2ec9ceaff7fc0d459c1a336c06663d05ad5f85e80f447
Instruction Fuzzy Hash: 4A511E72D0020AAFCB11EFA8C9849AEB7F9FF48304F14456AE519A7250E775EA15CF50

Function 02B86BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02B86BB2

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: c167f8b9073aa5b60816bbc9240d45d5c95694b5ce3e34426ed12da009d33523
Instruction ID: 7ae191eb455839b3227f429e353cdb697d6ddf9043c2b647f30a154b00086f13
Opcode Fuzzy Hash: c167f8b9073aa5b60816bbc9240d45d5c95694b5ce3e34426ed12da009d33523
Instruction Fuzzy Hash: 25218176904115FFDB117B60EE49E9F3FADDB043A4B104895F60AE2040EB31DA10DB74

Function 02B89064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,02B922F8), ref: 02B8907B
wsprintfA.USER32 ref: 02B890E9
CreateFileA.KERNEL32(02B922F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02B8910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02B89122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02B8912D
CloseHandle.KERNEL32(00000000), ref: 02B89134

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 93f687f013342e0e24df61c6dc945d006ce97e640a44e7d3f1edfb7735d9f82b
Instruction ID: eb517b17b54ea62987928ad40e7f7bf81ad9132440fccc5317c239774baf5c3b
Opcode Fuzzy Hash: 93f687f013342e0e24df61c6dc945d006ce97e640a44e7d3f1edfb7735d9f82b
Instruction Fuzzy Hash: 071187F2A401147BFB257661DD09EAF3A6FDFC4701F0088A5FB0EA6150EA708A51CE64

Function 02B8DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B8DD0F
GetCurrentThreadId.KERNEL32 ref: 02B8DD20
GetTickCount.KERNEL32 ref: 02B8DD2E
Sleep.KERNEL32(00000000,?,771B0F10,?,00000000,02B8E538,?,771B0F10,?,00000000,?,02B8A445), ref: 02B8DD3B
InterlockedExchange.KERNEL32(02B936B4,00000001), ref: 02B8DD44
GetCurrentThreadId.KERNEL32 ref: 02B8DD53

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 623afdd2fbc4bc5386ba40bdeea9578e77135e452ed526315c05995e434bf8e5
Instruction ID: c2e8f005365cb69647349c3145ec300349348ba2c7b09c15331546b22754c00b
Opcode Fuzzy Hash: 623afdd2fbc4bc5386ba40bdeea9578e77135e452ed526315c05995e434bf8e5
Instruction Fuzzy Hash: FFF0897398C1099FDB407BB5AA84B2977F6E745391F000C96E50DC3181D7249465CF61

Function 02B8AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02B8AD1C
lstrlenA.KERNEL32(?), ref: 02B8AD60
lstrlenA.KERNEL32(?), ref: 02B8AD69
lstrcpyA.KERNEL32(?,LocalHost), ref: 02B8AD7F

Strings

LocalHost, xrefs: 02B8AD79

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: a2fc2381f6aa12c6a147ce18c17440e2fca89813f7dc96af8bad75d246c0d727
Instruction ID: fa7ca69e367c735f0003e77975f34a2e377e0ae7acc3c663c2be2ef25eb38f08
Opcode Fuzzy Hash: a2fc2381f6aa12c6a147ce18c17440e2fca89813f7dc96af8bad75d246c0d727
Instruction Fuzzy Hash: EB01F1208841899EDF317A389844BB97F6AEB8674AF5014D7E4C8DB116FF649087C7A2

Function 02B84280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02B898FD,00000001,00000100,02B922F8,02B8A3C7), ref: 02B84290
CloseHandle.KERNEL32(02B8A3C7), ref: 02B843AB
CloseHandle.KERNEL32(00000001), ref: 02B843AE

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 5bebafd56713f4ea95d46ace3d93daaa867e4a09912d11d6b8d412c8e2a46034
Instruction ID: 985541e810f6479290de08b557ad83be5978a6ff4457771d6b7a06eb40af779b
Opcode Fuzzy Hash: 5bebafd56713f4ea95d46ace3d93daaa867e4a09912d11d6b8d412c8e2a46034
Instruction Fuzzy Hash: 76419AB1C0020ABBDF21BBA1DD85FAFBFB9EF40364F1045A5F618A2180D7348650CBA0

Function 02B86069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,02B864CF,00000000), ref: 02B8609C
LoadLibraryA.KERNEL32(?,?,02B864CF,00000000), ref: 02B860C3
GetProcAddress.KERNEL32(?,00000014), ref: 02B8614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02B8619E

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 35883bf135ac2c939be8202f5e8c6e971825501273cef02927692147c838cb1f
Instruction ID: 86ec21ed28ff544b4a11b377636b01baaa2da488cb36863e60a53581a674b8ed
Opcode Fuzzy Hash: 35883bf135ac2c939be8202f5e8c6e971825501273cef02927692147c838cb1f
Instruction Fuzzy Hash: 8C417B71E0020AEFDB14FF58C884B79B7B9EF04358F1484A9E919D7292E730E980CB90

Function 02B82923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186121d30a8cd54086ae10d336930cb2fdcaf144ac5378ca0a1d0d9d75de2d16
Instruction ID: 5b2ee24ac212bc52da55ea4c82d03cb96ee19ed16e5fe13d9f287b215a31832a
Opcode Fuzzy Hash: 186121d30a8cd54086ae10d336930cb2fdcaf144ac5378ca0a1d0d9d75de2d16
Instruction Fuzzy Hash: B2319E72A00219ABDB20AFA9CC81BBEB7F4EF48741F104896E958E6241E374D641CB54

Function 02B826FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B8272E
htons.WS2_32(00000001), ref: 02B82752
htons.WS2_32(0000000F), ref: 02B827D5
htons.WS2_32(00000001), ref: 02B827E3
sendto.WS2_32(?,02B92BF8,00000009,00000000,00000010,00000010), ref: 02B82802

Part of subcall function 02B8EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02B8EBFE,7FFF0001,?,02B8DB55,7FFF0001), ref: 02B8EBD3
Part of subcall function 02B8EBCC: RtlAllocateHeap.NTDLL(00000000,?,02B8DB55,7FFF0001), ref: 02B8EBDA

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: c369a0397e892ee4e1ca0c7cac6d35bd23d936a7211060fc3dad2e62bf6611d5
Instruction ID: 6231ed917f0555507519696d67e7a4ff320b8cf019794d2f0d672585359c4fe5
Opcode Fuzzy Hash: c369a0397e892ee4e1ca0c7cac6d35bd23d936a7211060fc3dad2e62bf6611d5
Instruction Fuzzy Hash: B3316D38E803C6AFD710BF75D980AA577A0EF19358B2948ADEC59CB312D732D852CB50

Function 02B89145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,02B922F8), ref: 02B8915F
GetModuleFileNameA.KERNEL32(00000000), ref: 02B89166
CharToOemA.USER32(?,?), ref: 02B89174
wsprintfA.USER32 ref: 02B891A9

Part of subcall function 02B89064: GetTempPathA.KERNEL32(00000400,?,00000000,02B922F8), ref: 02B8907B
Part of subcall function 02B89064: wsprintfA.USER32 ref: 02B890E9
Part of subcall function 02B89064: CreateFileA.KERNEL32(02B922F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02B8910E
Part of subcall function 02B89064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02B89122
Part of subcall function 02B89064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02B8912D
Part of subcall function 02B89064: CloseHandle.KERNEL32(00000000), ref: 02B89134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02B891E1

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 2fb29e5ac5e8fd68e502b9ac6637d640b3a81c85971da08dd155debe137741bd
Instruction ID: 9ac7a91df0a241d2c3b5c773d0ee0c32b3d4a21257edf68417b7c99b6a9b5ff4
Opcode Fuzzy Hash: 2fb29e5ac5e8fd68e502b9ac6637d640b3a81c85971da08dd155debe137741bd
Instruction Fuzzy Hash: 150140F79401587BDA20B6619D49FEF7B7CDB95701F0004A2FB49E2040D6749685CF70

Function 02B82419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,02B82491,?,?,?,02B8E844,-00000030,?,?,?,00000001), ref: 02B82429
lstrlenA.KERNEL32(?,?,02B82491,?,?,?,02B8E844,-00000030,?,?,?,00000001,02B81E3D,00000001,localcfg,lid_file_upd), ref: 02B8243E
lstrcmpiA.KERNEL32(?,?), ref: 02B82452
lstrlenA.KERNEL32(?,?,02B82491,?,?,?,02B8E844,-00000030,?,?,?,00000001,02B81E3D,00000001,localcfg,lid_file_upd), ref: 02B82467

Strings

localcfg, xrefs: 02B8241F

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: c312dbc61a4227b707c85f7cb5dcdce64103029660e37f653f352d2bd54a0361
Instruction ID: 8bc89b5bdb0f103f98711c67bd31bc251ce4dcb58fd163edbc0e128c22ac16c2
Opcode Fuzzy Hash: c312dbc61a4227b707c85f7cb5dcdce64103029660e37f653f352d2bd54a0361
Instruction Fuzzy Hash: 2E010832A00258EF8F11BF69C88499E7BA9EF44394B09C465ED5997200E330EA50CBA0

Function 02B81C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02B81CE1
wsprintfA.USER32 ref: 02B81D6B

Strings

%u.%u.%u.%u.%s, xrefs: 02B81CDB, 02B81D65
localcfg, xrefs: 02B81C70

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 25107c91c898458f392e875bcef4180af6cf7bb8616c50ecddc0c534efc7fcf0
Instruction ID: 86083cc6d7079258b5754d888e6bb30bb7e525aec42971c2ca71a9f33549845f
Opcode Fuzzy Hash: 25107c91c898458f392e875bcef4180af6cf7bb8616c50ecddc0c534efc7fcf0
Instruction Fuzzy Hash: BC419D729042989FDB21EF798D44BEE3BE99F49310F240495FD68D3151E634E605CFA0

Function 02B8E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02B8DD05: GetTickCount.KERNEL32 ref: 02B8DD0F
Part of subcall function 02B8DD05: InterlockedExchange.KERNEL32(02B936B4,00000001), ref: 02B8DD44
Part of subcall function 02B8DD05: GetCurrentThreadId.KERNEL32 ref: 02B8DD53

lstrcmpA.KERNEL32(771B0F18,00000000,?,771B0F10,00000000,?,02B85EC1), ref: 02B8E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,771B0F10,00000000,?,02B85EC1), ref: 02B8E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,771B0F10,00000000,?,02B85EC1), ref: 02B8E722

Strings

89ABCDEF, xrefs: 02B8E721

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 100616fa52b15d83a05622ebaa5b08f7d6280fdad8d1ce670386d14614e72ce4
Instruction ID: 31f9c9270af815ae5dde6db0852f1644059eb4991f1b0f4a2a7b00f91aa381ec
Opcode Fuzzy Hash: 100616fa52b15d83a05622ebaa5b08f7d6280fdad8d1ce670386d14614e72ce4
Instruction Fuzzy Hash: 7F31CF32A00716EBCF31AF64D884B667BE5FB01764F1048AAF95D8B552E770E884CB91

Function 02B8E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02B8E2A3,00000000,00000000,00000000,00020106,00000000,02B8E2A3,00000000,000000E4), ref: 02B8E0B2
RegSetValueExA.ADVAPI32(02B8E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,02B922F8), ref: 02B8E127
RegDeleteValueA.ADVAPI32(02B8E2A3,?,?,?,?,?,000000C8,02B922F8), ref: 02B8E158
RegCloseKey.ADVAPI32(02B8E2A3,?,?,?,?,000000C8,02B922F8,?,?,?,?,?,?,?,?,02B8E2A3), ref: 02B8E161

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 45b1e92f3937bd8a69e966786ae0f927da2f736314d09e0eef61076291bbf1d4
Instruction ID: ed7eb40953d39d5beebc3a23e6d02807d63e147fbc346e94f9b3aa8c10c641b1
Opcode Fuzzy Hash: 45b1e92f3937bd8a69e966786ae0f927da2f736314d09e0eef61076291bbf1d4
Instruction Fuzzy Hash: 01212F72A00219BBDF21AEA4DC89EAE7FB9EF05790F0044A1F908A6150E671DA54DB90

Function 02B83F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,02B8A3C7,00000000,00000000,000007D0,00000001), ref: 02B83FB8
GetLastError.KERNEL32 ref: 02B83FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 02B83FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B83FE6

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 21cbd8750953f1a8c078a13c4d2664595a6fecb430befa746baa531b8b062f45
Instruction ID: 572d556b3564055bbff241c33d9cfdc4e3fe148730c1b2f1f74244563bcd3007
Opcode Fuzzy Hash: 21cbd8750953f1a8c078a13c4d2664595a6fecb430befa746baa531b8b062f45
Instruction Fuzzy Hash: 4E01E97291011AABDF11EF94D945BEE7BBCEB04755F004491F906E2040DB71DA64CBB1

Function 02B83F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,02B8A3C7,00000000,00000000,000007D0,00000001), ref: 02B83F44
GetLastError.KERNEL32 ref: 02B83F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 02B83F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02B83F72

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: fee62b420c95218c7ff01fd36844286885d7f19c58da10e09c2deae1d404f4fa
Instruction ID: 0bb21c16112d3c8a403e57e01462b0ae94fc497ccdca81b9c0683a89e1ce061f
Opcode Fuzzy Hash: fee62b420c95218c7ff01fd36844286885d7f19c58da10e09c2deae1d404f4fa
Instruction Fuzzy Hash: 4901D372911119ABDB01EF90D984BEE7BBCEB04795F1048A6FA05E2040D7349A24CBA2

Function 02B84E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B84E9E
GetTickCount.KERNEL32 ref: 02B84EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 02B84EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 02B84EC3

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 8f6cd665a8c8846b8623afbdb4bcc81134cf79b0e7096a193de293eaa1377a69
Instruction ID: 9e318bd9cd5d5a851d2ee233be20698f160687ae0f68595e155fb0141442632e
Opcode Fuzzy Hash: 8f6cd665a8c8846b8623afbdb4bcc81134cf79b0e7096a193de293eaa1377a69
Instruction Fuzzy Hash: ECE0863364121957D61036B9AD84F6776599B453A2F010D71E60DD3180D656946285B1

Function 02B8A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B8A4D1
GetTickCount.KERNEL32 ref: 02B8A4E4
Sleep.KERNEL32(00000000,?,02B8C2E9,02B8C4E0,00000000,localcfg,?,02B8C4E0,02B93588,02B88810), ref: 02B8A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 02B8A4FA

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: c523013d1113274ca132ba65cbae137b36aee710f096a5026817c8bbd5a5f27a
Instruction ID: 04a8c6875b159f4fbe9187f217b23f0d21a275d43bd130008f9226b1c4247968
Opcode Fuzzy Hash: c523013d1113274ca132ba65cbae137b36aee710f096a5026817c8bbd5a5f27a
Instruction Fuzzy Hash: BAE07D3324020857CF0037B5AD84FAA33C8EB497F1F0A08A2FF0CE3141C61AA561C2B2

Function 02B84BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B84BDD
GetTickCount.KERNEL32 ref: 02B84BEC
Sleep.KERNEL32(00000000,?,?,?,0301E054,02B850F2), ref: 02B84BF9
InterlockedExchange.KERNEL32(0301E048,00000001), ref: 02B84C02

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 6e7563d8f1b0ccffa57892ba84bbf48e2338d534df8eb35bc6d5df8d7f9adaf7
Instruction ID: 6bc97fae1444fdc1aaca54abc7d8e25e2187e66d38b9ac860242e1836e1cf0b8
Opcode Fuzzy Hash: 6e7563d8f1b0ccffa57892ba84bbf48e2338d534df8eb35bc6d5df8d7f9adaf7
Instruction Fuzzy Hash: 02E0CD3768121957C71037B65E84F5677ACDB453A1F060CB2F70CD3140C5569451C6B1

Function 02B830FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B83103
GetTickCount.KERNEL32 ref: 02B8310F
Sleep.KERNEL32(00000000), ref: 02B8311C
InterlockedExchange.KERNEL32(?,00000001), ref: 02B83128

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1e4990814211adf4f85c30ffd08dc1cfcc741483694d0817a6aa87a221539e86
Instruction ID: cd3c15247a57dc4441cc2edce791579171ee1a6848052a92aaaf55c393fdfd29
Opcode Fuzzy Hash: 1e4990814211adf4f85c30ffd08dc1cfcc741483694d0817a6aa87a221539e86
Instruction Fuzzy Hash: 99E0C23164021AABDB007B75AE85B696A9ADF84FA1F010CB1F209D3090C6504860CA71

Function 02B88CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B88D02
GetTickCount.KERNEL32 ref: 02B88DA1

Strings

localcfg, xrefs: 02B88D19

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 18368221942263617a2ff1e840e59c1412471849dd4a090bc8953ed22083f74b
Instruction ID: cfa7dff07abd37bcccf6cde28cacf1d87874995000a3d2309484d1535c5e7a0f
Opcode Fuzzy Hash: 18368221942263617a2ff1e840e59c1412471849dd4a090bc8953ed22083f74b
Instruction Fuzzy Hash: FC21D232A1411DAFCB10BF68D98065ABBBAEF20354BA505DED409D7111EB30E950CB50

Function 02B8BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02B8BFD0
wsprintfA.USER32 ref: 02B8C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 02B8C057

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 67e851854120f861f5da0a5e2ac450dead785364edfb7bd8f7d5f71c1c107c44
Instruction ID: cbb7d4051d49d3701157e1e934642a758c08c05ab8da35a36d6ed5a1e5008366
Opcode Fuzzy Hash: 67e851854120f861f5da0a5e2ac450dead785364edfb7bd8f7d5f71c1c107c44
Instruction Fuzzy Hash: CC119772500100FFDB429AA9CD44E567FA6FF88358B34859CF6188E126D633D863EB50

Function 02B826B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 02B826C3
inet_ntoa.WS2_32(?), ref: 02B826E4

Strings

localcfg, xrefs: 02B826CD, 02B826D2, 02B826DE

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: ac16451542a2f8624ea68b959944c1e1a9c50dabbf14823b21a7bc579d00891e
Instruction ID: c4cf4a56181b61b40c377091f8e230a2f1f209a53951736367eb91f0b32988eb
Opcode Fuzzy Hash: ac16451542a2f8624ea68b959944c1e1a9c50dabbf14823b21a7bc579d00891e
Instruction Fuzzy Hash: F3F037775482097FEF007FA4ED05AAA379DDF05650F144865FD0CDA090DB71E950D798

Function 02B8EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,02B8EB54,_alldiv,02B8F0B7,80000001,00000000,00989680,00000000,?,?,?,02B8E342,00000000,7686EA50,80000001,00000000), ref: 02B8EAF2
GetProcAddress.KERNEL32(776F0000,00000000), ref: 02B8EB07

Strings

ntdll.dll, xrefs: 02B8EAED

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 3eb7ba9bc0bbc0294932af9c97b584b8a91a872c15caee6188a578beaeb07832
Instruction ID: 9192a5ab57e31185019da1a535d4331d15903d011fbf6c8c52e16620fa29fb64
Opcode Fuzzy Hash: 3eb7ba9bc0bbc0294932af9c97b584b8a91a872c15caee6188a578beaeb07832
Instruction Fuzzy Hash: 6CD0C935A843039BDF126FA9AB8BE0A7AE8EB50781B504C95F40AD3210E731E464DA00

Function 02B82F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02B82D21: GetModuleHandleA.KERNEL32(00000000,771B23A0,?,00000000,02B82F01,?,02B820FF,02B92000), ref: 02B82D3A
Part of subcall function 02B82D21: LoadLibraryA.KERNEL32(?), ref: 02B82D4A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02B82F73
HeapFree.KERNEL32(00000000), ref: 02B82F7A

Memory Dump Source

Source File: 00000015.00000002.2522813570.0000000002B80000.00000040.00000400.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2b80000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: a9ba42362c8ce043f60e80fa953c219e35f14a2f5e7f7c14abe8c66429398163
Instruction ID: e4acbb5a4c534cadd83bcb581ec8b2d215b198ee274eac7429d50bb62985f418
Opcode Fuzzy Hash: a9ba42362c8ce043f60e80fa953c219e35f14a2f5e7f7c14abe8c66429398163
Instruction Fuzzy Hash: 99518F7190025AAFDF01AF64D888AF9B7B5FF05704F1445A9EC9AD7210E732DA19CF90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report igvdwmhd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\ybyrikeu.exe

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

C:\Windows\SysWOW64\ptcoklzf\ybyrikeu.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
igvdwmhd.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre