Edit tour

Windows Analysis Report
bEsOrli29K.exe

Overview

General Information

Sample name:	bEsOrli29K.exe
Analysis ID:	1503014
MD5:	a3247152e18ba6e88311f082a86515d3
SHA1:	80da2f14bb17f2d3ff1df6faf25622ebb8cf00c8
SHA256:	02c6f9163a5d988cee3ab12c11e03b18329c26d6b4863004f943133654693e97
Tags:	exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Modifies existing windows services

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

bEsOrli29K.exe (PID: 5344 cmdline: "C:\Users\user\Desktop\bEsOrli29K.exe" MD5: A3247152E18BA6E88311F082A86515D3)

cmd.exe (PID: 2672 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\edgikboy\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6488 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe" C:\Windows\SysWOW64\edgikboy\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7060 cmdline: "C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 1576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3620 cmdline: "C:\Windows\System32\sc.exe" description edgikboy "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 3920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6056 cmdline: "C:\Windows\System32\sc.exe" start edgikboy MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1848 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 5520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 5552 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 1032 MD5: C31336C1EFC2CCB44B4326EA793040F2)

pwdgvjcm.exe (PID: 5496 cmdline: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d"C:\Users\user\Desktop\bEsOrli29K.exe" MD5: A0F884B02EE655DEE8140FACC411FA01)

svchost.exe (PID: 3552 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 3008 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 392 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 5712 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 1784 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5344 -ip 5344 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5248 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5496 -ip 5496 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 1576 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2281554914.0000000000623000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x990:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2181701002.000000000069A000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xfe0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: bEsOrli29K.exe PID: 5344	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: pwdgvjcm.exe PID: 5496	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 3552	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.bEsOrli29K.exe.5f0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.bEsOrli29K.exe.5f0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.bEsOrli29K.exe.5f0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.bEsOrli29K.exe.5f0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.bEsOrli29K.exe.5f0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.pwdgvjcm.exe.5f0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.pwdgvjcm.exe.5f0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.bEsOrli29K.exe.540e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.bEsOrli29K.exe.540e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.pwdgvjcm.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.pwdgvjcm.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.pwdgvjcm.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
19.2.svchost.exe.4c0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
19.2.svchost.exe.4c0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
19.2.svchost.exe.4c0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.pwdgvjcm.exe.5f0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.pwdgvjcm.exe.5f0000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.pwdgvjcm.exe.5f0000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.pwdgvjcm.exe.5f0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.pwdgvjcm.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.pwdgvjcm.exe.5f0000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.pwdgvjcm.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.pwdgvjcm.exe.5f0000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.pwdgvjcm.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
19.2.svchost.exe.4c0000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
19.2.svchost.exe.4c0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
19.2.svchost.exe.4c0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.pwdgvjcm.exe.5d0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.pwdgvjcm.exe.5d0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.bEsOrli29K.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.bEsOrli29K.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.bEsOrli29K.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.pwdgvjcm.exe.5d0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.pwdgvjcm.exe.5d0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.pwdgvjcm.exe.5d0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.pwdgvjcm.exe.5f0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.3.pwdgvjcm.exe.5f0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.pwdgvjcm.exe.5f0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.bEsOrli29K.exe.540e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.bEsOrli29K.exe.540e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.bEsOrli29K.exe.540e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.bEsOrli29K.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.bEsOrli29K.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.bEsOrli29K.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d"C:\Users\user\Desktop\bEsOrli29K.exe", ParentImage: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, ParentProcessId: 5496, ParentProcessName: pwdgvjcm.exe, ProcessCommandLine: svchost.exe, ProcessId: 3552, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\bEsOrli29K.exe", ParentImage: C:\Users\user\Desktop\bEsOrli29K.exe, ParentProcessId: 5344, ParentProcessName: bEsOrli29K.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7060, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.11.0, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 3552, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49713

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d"C:\Users\user\Desktop\bEsOrli29K.exe", ParentImage: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, ParentProcessId: 5496, ParentProcessName: pwdgvjcm.exe, ProcessCommandLine: svchost.exe, ProcessId: 3552, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 3552, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\edgikboy

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\bEsOrli29K.exe", ParentImage: C:\Users\user\Desktop\bEsOrli29K.exe, ParentProcessId: 5344, ParentProcessName: bEsOrli29K.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7060, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 5712, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: bEsOrli29K.exe

Avira: detected

Antivirus detection for URL or domain

Source: jotunheim.name:443	Avira URL Cloud: Label: malware
Source: vanaheim.cn:443	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe

Avira: detection malicious, Label: HEUR/AGEN.1316832

Found malware configuration

Source: 0.3.bEsOrli29K.exe.5f0000.0.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: bEsOrli29K.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Unpacked PE file: 0.2.bEsOrli29K.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Unpacked PE file: 12.2.pwdgvjcm.exe.400000.0.unpack

Source: bEsOrli29K.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\bEsOrli29K.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\edgikboy

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.184.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 77.232.41.29 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.77 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.11.0 52.101.11.0
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150
Source: Joe Sandbox View	IP Address: 67.195.204.77 67.195.204.77

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU
Source: Joe Sandbox View	ASN Name: YAHOO-3US YAHOO-3US

Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 52.101.11.0:25
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 67.195.204.77:25
Source: global traffic	TCP traffic: 192.168.2.5:49717 -> 64.233.184.26:25
Source: global traffic	TCP traffic: 192.168.2.5:49720 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta7.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 0.3.bEsOrli29K.exe.5f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.5f0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.5f0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bEsOrli29K.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.5d0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.pwdgvjcm.exe.5f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bEsOrli29K.exe.540e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bEsOrli29K.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bEsOrli29K.exe PID: 5344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pwdgvjcm.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3552, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.3.bEsOrli29K.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.bEsOrli29K.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.bEsOrli29K.exe.5f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.bEsOrli29K.exe.5f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.pwdgvjcm.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.pwdgvjcm.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.bEsOrli29K.exe.540e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.bEsOrli29K.exe.540e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.pwdgvjcm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.pwdgvjcm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 19.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 19.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.pwdgvjcm.exe.5f0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.pwdgvjcm.exe.5f0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.pwdgvjcm.exe.5f0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.pwdgvjcm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.pwdgvjcm.exe.5f0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.pwdgvjcm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 19.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 19.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.pwdgvjcm.exe.5d0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.pwdgvjcm.exe.5d0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.bEsOrli29K.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.bEsOrli29K.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.pwdgvjcm.exe.5d0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.pwdgvjcm.exe.5d0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.pwdgvjcm.exe.5f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.pwdgvjcm.exe.5f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.bEsOrli29K.exe.540e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.bEsOrli29K.exe.540e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.bEsOrli29K.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.bEsOrli29K.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2281554914.0000000000623000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2181701002.000000000069A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\edgikboy\

Jump to behavior

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_00427861	0_2_00427861
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_0042A210	0_2_0042A210
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_0042731D	0_2_0042731D
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_00426DD9	0_2_00426DD9
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_00429BEB	0_2_00429BEB
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_0040C913	12_2_0040C913
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_00427861	12_2_00427861
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_0042A210	12_2_0042A210
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_0042731D	12_2_0042731D
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_00426DD9	12_2_00426DD9
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_00429BEB	12_2_00429BEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_004CC913	19_2_004CC913

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: String function: 005427AB appears 35 times
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5344 -ip 5344

Source: bEsOrli29K.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.3.bEsOrli29K.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.bEsOrli29K.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.bEsOrli29K.exe.5f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.bEsOrli29K.exe.5f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.pwdgvjcm.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.pwdgvjcm.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.bEsOrli29K.exe.540e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.bEsOrli29K.exe.540e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.pwdgvjcm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.pwdgvjcm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 19.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 19.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.pwdgvjcm.exe.5f0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.pwdgvjcm.exe.5f0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.pwdgvjcm.exe.5f0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.pwdgvjcm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.pwdgvjcm.exe.5f0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.pwdgvjcm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 19.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 19.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.pwdgvjcm.exe.5d0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.pwdgvjcm.exe.5d0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.bEsOrli29K.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.bEsOrli29K.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.pwdgvjcm.exe.5d0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.pwdgvjcm.exe.5d0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.pwdgvjcm.exe.5f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.pwdgvjcm.exe.5f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.bEsOrli29K.exe.540e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.bEsOrli29K.exe.540e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.bEsOrli29K.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.bEsOrli29K.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2281554914.0000000000623000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2181701002.000000000069A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: classification engine

Classification label: mal100.troj.evad.winEXE@32/3@9/5

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_0069B00E CreateToolhelp32Snapshot,Module32First,

0_2_0069B00E

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_004C9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	19_2_004C9A6B

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:1784:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5632:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5248:64:WilError_03

Source: C:\Users\user\Desktop\bEsOrli29K.exe

File created: C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe

Jump to behavior

Source: bEsOrli29K.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\bEsOrli29K.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\bEsOrli29K.exe

File read: C:\Users\user\Desktop\bEsOrli29K.exe

Jump to behavior

Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_12-17036

Source: unknown	Process created: C:\Users\user\Desktop\bEsOrli29K.exe "C:\Users\user\Desktop\bEsOrli29K.exe"
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\edgikboy\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe" C:\Windows\SysWOW64\edgikboy\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description edgikboy "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start edgikboy
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d"C:\Users\user\Desktop\bEsOrli29K.exe"
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5344 -ip 5344
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 1032
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5496 -ip 5496
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 392
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\edgikboy\	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe" C:\Windows\SysWOW64\edgikboy\	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description edgikboy "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start edgikboy	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5344 -ip 5344	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 1032	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5496 -ip 5496	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 392	Jump to behavior

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\bEsOrli29K.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Unpacked PE file: 0.2.bEsOrli29K.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Unpacked PE file: 12.2.pwdgvjcm.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Unpacked PE file: 0.2.bEsOrli29K.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Unpacked PE file: 12.2.pwdgvjcm.exe.400000.0.unpack

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_0069E2F6 push 0000002Bh; iretd		0_2_0069E2FC
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_00626CA6 push 0000002Bh; iretd		12_2_00626CAC

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe

Source: C:\Users\user\Desktop\bEsOrli29K.exe	File created: C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\edgikboy

Jump to behavior

Source: C:\Users\user\Desktop\bEsOrli29K.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\besorli29k.exe

Jump to behavior

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

19_2_004C199C

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-18050
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_19-6432
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-18368

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_19-6140

Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-17421
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_19-7325
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-17398

Source: C:\Windows\SysWOW64\svchost.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_19-7419

Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_12-17051
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-16973

Source: C:\Users\user\Desktop\bEsOrli29K.exe	API coverage: 6.0 %
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	API coverage: 4.8 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_004250B9 GetSystemTimes followed by cmp: cmp dword ptr [0043e834h], 0ah and CTI: jne 00425244h		0_2_004250B9
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_004250B9 GetSystemTimes followed by cmp: cmp dword ptr [0043e834h], 0ah and CTI: jne 00425244h		12_2_004250B9

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000013.00000002.3293295066.0000000002A00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;

Source: C:\Users\user\Desktop\bEsOrli29K.exe

API call chain: ExitProcess graph end node

graph_0-17401

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_19-7665
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_12-18429

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_0054092B mov eax, dword ptr fs:[00000030h]	0_2_0054092B
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_00540D90 mov eax, dword ptr fs:[00000030h]	0_2_00540D90
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_0069A8EB push dword ptr fs:[00000030h]	0_2_0069A8EB
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_005D092B mov eax, dword ptr fs:[00000030h]	12_2_005D092B
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_005D0D90 mov eax, dword ptr fs:[00000030h]	12_2_005D0D90
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_0062329B push dword ptr fs:[00000030h]	12_2_0062329B

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_004C9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	19_2_004C9A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.184.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 77.232.41.29 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.77 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 4C0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 4C0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4C0000			Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 243008			Jump to behavior

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\edgikboy\	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe" C:\Windows\SysWOW64\edgikboy\	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description edgikboy "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start edgikboy	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5344 -ip 5344	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 1032	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5496 -ip 5496	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 392	Jump to behavior

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\bEsOrli29K.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\bEsOrli29K.exe

0_2_00407809

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\bEsOrli29K.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 0.3.bEsOrli29K.exe.5f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.5f0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.5f0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bEsOrli29K.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.5d0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.pwdgvjcm.exe.5f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bEsOrli29K.exe.540e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bEsOrli29K.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bEsOrli29K.exe PID: 5344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pwdgvjcm.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3552, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 0.3.bEsOrli29K.exe.5f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.4c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.5f0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.5f0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.4c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bEsOrli29K.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.pwdgvjcm.exe.5d0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.pwdgvjcm.exe.5f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bEsOrli29K.exe.540e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bEsOrli29K.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bEsOrli29K.exe PID: 5344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pwdgvjcm.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3552, type: MEMORYSTR

Source: C:\Users\user\Desktop\bEsOrli29K.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe	Code function: 12_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_004C88B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	19_2_004C88B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	2 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
bEsOrli29K.exe	100%	Avira	HEUR/AGEN.1316832
bEsOrli29K.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe	100%	Avira	HEUR/AGEN.1316832
C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
jotunheim.name:443	100%	Avira URL Cloud	malware
vanaheim.cn:443	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mxs.mail.ru	217.69.139.150	true	true	unknown
mta7.am0.yahoodns.net	67.195.204.77	true	true	unknown
microsoft-com.mail.protection.outlook.com	52.101.11.0	true	true	unknown
vanaheim.cn	77.232.41.29	true	true	unknown
smtp.google.com	64.233.184.26	true	false	unknown
google.com	unknown	unknown	true	unknown
yahoo.com	unknown	unknown	true	unknown
mail.ru	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	Avira URL Cloud: phishing	unknown
jotunheim.name:443	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.101.11.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
64.233.184.26	smtp.google.com	United States	15169	GOOGLEUS	false
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
67.195.204.77	mta7.am0.yahoodns.net	United States	26101	YAHOO-3US	true
77.232.41.29	vanaheim.cn	Russian Federation	28968	EUT-ASEUTIPNetworkRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1503014
Start date and time:	2024-09-02 16:59:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bEsOrli29K.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@32/3@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 64 Number of non-executed functions: 268
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.236.44.162, 20.76.201.171, 20.70.246.20, 20.231.239.246, 20.112.250.133
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: bEsOrli29K.exe

Simulations

Behavior and APIs

Time	Type	Description
11:01:55	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.11.0	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse
217.69.139.150	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	I5vhb7vJPS.exe	Get hash	malicious	Tofsee	Browse
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse
67.195.204.77	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	data.log.exe	Get hash	malicious	Unknown	Browse
	message.elm.exe	Get hash	malicious	Unknown	Browse
	message.txt.exe	Get hash	malicious	Unknown	Browse
	test.dat.exe	Get hash	malicious	Unknown	Browse
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB9504-x86.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
microsoft-com.mail.protection.outlook.com	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	.exe	Get hash	malicious	Unknown	Browse	52.101.40.26
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	setup.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
vanaheim.cn	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	setup.exe	Get hash	malicious	Tofsee	Browse	185.218.0.41
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	195.133.13.231
mta7.am0.yahoodns.net	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	setup.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	67.195.204.77
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	67.195.204.74
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94
	SecuriteInfo.com.Win32.BotX-gen.31335.5127.exe	Get hash	malicious	Tofsee	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.111
mxs.mail.ru	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	setup.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	5CxmQXL0LD.exe	Get hash	malicious	SystemBC	Browse	94.100.180.31
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAILRU-ASMailRuRU	http://manga-netflix10737.tinyblogging.com.xx3.kz/	Get hash	malicious	Unknown	Browse	94.100.180.209
	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	188.93.63.129
	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	188.93.63.180
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	SecuriteInfo.com.Trojan.Crypt.28917.30010.exe	Get hash	malicious	Unknown	Browse	5.61.236.163
	IISz6QDXkY.elf	Get hash	malicious	Mirai	Browse	5.61.23.77
YAHOO-3US	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	74.6.99.126
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	67.195.204.73
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	67.195.204.74
	arm7.elf	Get hash	malicious	Mirai	Browse	98.139.166.43
	https://www.ima-india.com/index.php	Get hash	malicious	Unknown	Browse	74.6.138.67
	https://www.ima-india.com/index.php	Get hash	malicious	Unknown	Browse	74.6.138.67
	https://www.ima-india.com/index.php?option=com_content&view=article&id=1092&Itemid=483	Get hash	malicious	Unknown	Browse	74.6.138.65
	D8OieODwpn.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	72.30.110.165
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	67.195.204.77
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	67.195.204.74
MICROSOFT-CORP-MSN-AS-BLOCKUS	1RGKUwuqi0.exe	Get hash	malicious	Remcos, PureLog Stealer, XRed	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	3.dll	Get hash	malicious	Unknown	Browse	20.42.65.92
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	1Td9Py5FAy.xls	Get hash	malicious	Unknown	Browse	13.107.246.67
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	REQST_PRC 410240.exe	Get hash	malicious	FormBook	Browse	20.2.249.7
	file.exe	Get hash	malicious	Unknown	Browse	52.123.243.70

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe

Download File

Process:	C:\Users\user\Desktop\bEsOrli29K.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14984704
Entropy (8bit):	4.9830233944354125
Encrypted:	false
SSDEEP:	6144:4LqN3Bt36iM/ofpKhn9nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn:4WN3X363H
MD5:	A0F884B02EE655DEE8140FACC411FA01
SHA1:	CB93EDC0386F266F4B49B1EE99A206E2ACEDF8A8
SHA-256:	4F107BE1DBED955B6EA91A5708FBAFE2D8700B49872526C52A90445024AA0219
SHA-512:	9DE9571B13D0648AAE33AADFE56DE6C035966569A9C2FFD37CD3C814359F35D1A87CFB5A340CC1C9A08E187F1F3783426D7F4CD24082A8EB9A6F59D7C679298A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-*..iK..iK..iK....\|.hK..w.n.KK..w...pK..w.i..K..N...lK..iK...K..w.`.hK..w.~.hK..w.{.hK..RichiK..................PE..L....x.d............................I.............@..................................h..........................................<........o...........................................................................................................text.............................. ..`.rdata...$.......&..................@..@.data....).......&..................@....rsrc....o..........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14984704
Entropy (8bit):	4.9830233944354125
Encrypted:	false
SSDEEP:	6144:4LqN3Bt36iM/ofpKhn9nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn:4WN3X363H
MD5:	A0F884B02EE655DEE8140FACC411FA01
SHA1:	CB93EDC0386F266F4B49B1EE99A206E2ACEDF8A8
SHA-256:	4F107BE1DBED955B6EA91A5708FBAFE2D8700B49872526C52A90445024AA0219
SHA-512:	9DE9571B13D0648AAE33AADFE56DE6C035966569A9C2FFD37CD3C814359F35D1A87CFB5A340CC1C9A08E187F1F3783426D7F4CD24082A8EB9A6F59D7C679298A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-*..iK..iK..iK....\|.hK..w.n.KK..w...pK..w.i..K..N...lK..iK...K..w.`.hK..w.~.hK..w.{.hK..RichiK..................PE..L....x.d............................I.............@..................................h..........................................<........o...........................................................................................................text.............................. ..`.rdata...$.......&..................@..@.data....).......&..................@....rsrc....o..........................@..@................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.860638527068354
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bEsOrli29K.exe
File size:	218'624 bytes
MD5:	a3247152e18ba6e88311f082a86515d3
SHA1:	80da2f14bb17f2d3ff1df6faf25622ebb8cf00c8
SHA256:	02c6f9163a5d988cee3ab12c11e03b18329c26d6b4863004f943133654693e97
SHA512:	b09fc49d7126b37c37f499be522c4b57e7538d2f64600bd789c93d90a315a023f0fbed9466c6069a38bb8c80bc9a6b250fcaec03b59ecfb3a40754c235c3e6d8
SSDEEP:	3072:AOFL8HN3BB33u/iMUk6efofpWqX2hnesi5kb:tLqN3Bt36iM/ofpKhn9
TLSH:	2524BE213AA1F032D1A745709970FAE06A7B783222B5C0CB7FA41B7F6E602D15A1735F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-*..iK..iK..iK....\|.hK..w.n.KK..w...pK..w.i..K..N...lK..iK...K..w.`.hK..w.~.hK..w.{.hK..RichiK..................PE..L....x.d...

File Icon


Icon Hash:	73a733b18b8383cc

Static PE Info

General

Entrypoint:	0x401749
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64D978D5 [Mon Aug 14 00:44:05 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	48018783cf28f3141db6304599edb5a2

Entrypoint Preview

Instruction
call 00007FC384F0E9C5h
jmp 00007FC384F0A52Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0042FF58h], eax
mov dword ptr [0042FF54h], ecx
mov dword ptr [0042FF50h], edx
mov dword ptr [0042FF4Ch], ebx
mov dword ptr [0042FF48h], esi
mov dword ptr [0042FF44h], edi
mov word ptr [0042FF70h], ss
mov word ptr [0042FF64h], cs
mov word ptr [0042FF40h], ds
mov word ptr [0042FF3Ch], es
mov word ptr [0042FF38h], fs
mov word ptr [0042FF34h], gs
pushfd
pop dword ptr [0042FF68h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0042FF5Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0042FF60h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0042FF6Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0042FEA8h], 00010001h
mov eax, dword ptr [0042FF60h]
mov dword ptr [0042FE5Ch], eax
mov dword ptr [0042FE50h], C0000409h
mov dword ptr [0042FE54h], 00000001h
mov eax, dword ptr [0042E004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0042E008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000A4h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2cb8c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x41000	0x6fb8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x1a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x295cb	0x29600	0e492b32e175e9c3c43624614dc9d116	False	0.5475535781722054	data	5.9689030476065525	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x24b0	0x2600	8a4650538da98cbdbe21505d67522f62	False	0.36944901315789475	data	5.432191623802317	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2e000	0x129c8	0x2600	23538072e22f8730f3a503bc5f6b23e0	False	0.216796875	data	2.335729383671652	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x41000	0x6fb8	0x7000	473eb0a900d01c016c9446aef32ca7d4	False	0.48814174107142855	data	4.9548090688116115	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x41340	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.35980810234541577
RT_ICON	0x421e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.569043321299639
RT_ICON	0x42a90	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6100230414746544
RT_ICON	0x43158	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6640173410404624
RT_ICON	0x436c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.43060165975103737
RT_ICON	0x45c68	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.5360655737704918
RT_ICON	0x465f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.5212765957446809
RT_STRING	0x46cb8	0x66	data			0.6274509803921569
RT_STRING	0x46d20	0x21e	data			0.5055350553505535
RT_STRING	0x46f40	0x608	data			0.43976683937823835
RT_STRING	0x47548	0xce	data			0.5825242718446602
RT_STRING	0x47618	0x78e	data			0.41985522233712513
RT_STRING	0x47da8	0x210	data			0.5151515151515151
RT_GROUP_ICON	0x46a58	0x68	data	Turkish	Turkey	0.7115384615384616
RT_VERSION	0x46ac0	0x1f8	data			0.5694444444444444

Imports

DLL

Import

KERNEL32.dll

GetComputerNameA, GetFullPathNameA, GetNumaProcessorNode, GetProcessIoCounters, OpenJobObjectA, UnlockFile, GetTimeFormatA, GetModuleHandleW, GetTickCount, GetDateFormatA, GetSystemTimes, GlobalAlloc, LoadLibraryW, FormatMessageW, InitAtomTable, HeapCreate, FlushInstructionCache, GetProcAddress, GetNumaHighestNodeNumber, GetAtomNameA, LoadLibraryA, InterlockedExchangeAdd, SetCalendarInfoW, VirtualLock, HeapLock, GetCommMask, GetCurrentConsoleFont, SetCommMask, FoldStringA, lstrcatW, FreeEnvironmentStringsW, VirtualProtect, EnumDateFormatsW, SetFileShortNameA, DebugBreak, GetModuleHandleA, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, EnterCriticalSection, LeaveCriticalSection, ReadFile, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, GetLastError, InterlockedDecrement, Sleep, HeapSize, ExitProcess, WriteFile, GetModuleFileNameA, GetModuleFileNameW, GetEnvironmentStringsW, GetCommandLineW, VirtualFree, HeapFree, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, VirtualAlloc, HeapReAlloc, RtlUnwind, MultiByteToWideChar, InitializeCriticalSectionAndSpinCount, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, FlushFileBuffers, CreateFileA, CloseHandle, RaiseException

USER32.dll

InflateRect, GetActiveWindow, LoadIconA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2024 17:01:12.894964933 CEST	49713	25	192.168.2.5	52.101.11.0
Sep 2, 2024 17:01:13.899575949 CEST	49713	25	192.168.2.5	52.101.11.0
Sep 2, 2024 17:01:15.915163994 CEST	49713	25	192.168.2.5	52.101.11.0
Sep 2, 2024 17:01:16.052149057 CEST	49714	443	192.168.2.5	77.232.41.29
Sep 2, 2024 17:01:16.052184105 CEST	443	49714	77.232.41.29	192.168.2.5
Sep 2, 2024 17:01:16.052258015 CEST	49714	443	192.168.2.5	77.232.41.29
Sep 2, 2024 17:01:19.930856943 CEST	49713	25	192.168.2.5	52.101.11.0
Sep 2, 2024 17:01:27.930934906 CEST	49713	25	192.168.2.5	52.101.11.0
Sep 2, 2024 17:01:32.932591915 CEST	49715	25	192.168.2.5	67.195.204.77
Sep 2, 2024 17:01:33.930762053 CEST	49715	25	192.168.2.5	67.195.204.77
Sep 2, 2024 17:01:35.930895090 CEST	49715	25	192.168.2.5	67.195.204.77
Sep 2, 2024 17:01:39.930913925 CEST	49715	25	192.168.2.5	67.195.204.77
Sep 2, 2024 17:01:47.930753946 CEST	49715	25	192.168.2.5	67.195.204.77
Sep 2, 2024 17:01:53.267651081 CEST	49717	25	192.168.2.5	64.233.184.26
Sep 2, 2024 17:01:54.274552107 CEST	49717	25	192.168.2.5	64.233.184.26
Sep 2, 2024 17:01:56.040247917 CEST	49714	443	192.168.2.5	77.232.41.29
Sep 2, 2024 17:01:56.040330887 CEST	443	49714	77.232.41.29	192.168.2.5
Sep 2, 2024 17:01:56.040410995 CEST	49714	443	192.168.2.5	77.232.41.29
Sep 2, 2024 17:01:56.150238991 CEST	49718	443	192.168.2.5	77.232.41.29
Sep 2, 2024 17:01:56.150276899 CEST	443	49718	77.232.41.29	192.168.2.5
Sep 2, 2024 17:01:56.150420904 CEST	49718	443	192.168.2.5	77.232.41.29
Sep 2, 2024 17:01:56.274487019 CEST	49717	25	192.168.2.5	64.233.184.26
Sep 2, 2024 17:02:00.290184021 CEST	49717	25	192.168.2.5	64.233.184.26
Sep 2, 2024 17:02:08.305799007 CEST	49717	25	192.168.2.5	64.233.184.26
Sep 2, 2024 17:02:13.327121019 CEST	49720	25	192.168.2.5	217.69.139.150
Sep 2, 2024 17:02:14.321377039 CEST	49720	25	192.168.2.5	217.69.139.150
Sep 2, 2024 17:02:16.337065935 CEST	49720	25	192.168.2.5	217.69.139.150
Sep 2, 2024 17:02:20.352616072 CEST	49720	25	192.168.2.5	217.69.139.150
Sep 2, 2024 17:02:28.352631092 CEST	49720	25	192.168.2.5	217.69.139.150
Sep 2, 2024 17:02:36.166172028 CEST	49718	443	192.168.2.5	77.232.41.29
Sep 2, 2024 17:02:36.166285038 CEST	443	49718	77.232.41.29	192.168.2.5
Sep 2, 2024 17:02:36.166354895 CEST	49718	443	192.168.2.5	77.232.41.29
Sep 2, 2024 17:02:36.300311089 CEST	49721	443	192.168.2.5	77.232.41.29
Sep 2, 2024 17:02:36.300357103 CEST	443	49721	77.232.41.29	192.168.2.5
Sep 2, 2024 17:02:36.300431967 CEST	49721	443	192.168.2.5	77.232.41.29
Sep 2, 2024 17:02:54.775134087 CEST	49723	25	192.168.2.5	52.101.11.0
Sep 2, 2024 17:02:55.774413109 CEST	49723	25	192.168.2.5	52.101.11.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2024 17:01:12.840128899 CEST	61284	53	192.168.2.5	1.1.1.1
Sep 2, 2024 17:01:12.894134998 CEST	53	61284	1.1.1.1	192.168.2.5
Sep 2, 2024 17:01:15.775536060 CEST	60405	53	192.168.2.5	1.1.1.1
Sep 2, 2024 17:01:16.051440001 CEST	53	60405	1.1.1.1	192.168.2.5
Sep 2, 2024 17:01:32.900233984 CEST	60932	53	192.168.2.5	1.1.1.1
Sep 2, 2024 17:01:32.921876907 CEST	53	60932	1.1.1.1	192.168.2.5
Sep 2, 2024 17:01:32.922560930 CEST	54224	53	192.168.2.5	1.1.1.1
Sep 2, 2024 17:01:32.932095051 CEST	53	54224	1.1.1.1	192.168.2.5
Sep 2, 2024 17:01:52.946901083 CEST	55536	53	192.168.2.5	1.1.1.1
Sep 2, 2024 17:01:53.256279945 CEST	53	55536	1.1.1.1	192.168.2.5
Sep 2, 2024 17:01:53.257189989 CEST	64587	53	192.168.2.5	1.1.1.1
Sep 2, 2024 17:01:53.267031908 CEST	53	64587	1.1.1.1	192.168.2.5
Sep 2, 2024 17:02:13.259567022 CEST	57801	53	192.168.2.5	1.1.1.1
Sep 2, 2024 17:02:13.266614914 CEST	53	57801	1.1.1.1	192.168.2.5
Sep 2, 2024 17:02:13.267452955 CEST	50145	53	192.168.2.5	1.1.1.1
Sep 2, 2024 17:02:13.325735092 CEST	53	50145	1.1.1.1	192.168.2.5
Sep 2, 2024 17:02:54.765754938 CEST	54862	53	192.168.2.5	1.1.1.1
Sep 2, 2024 17:02:54.774537086 CEST	53	54862	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 2, 2024 17:01:12.840128899 CEST	192.168.2.5	1.1.1.1	0x9eac	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:15.775536060 CEST	192.168.2.5	1.1.1.1	0x8151	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:32.900233984 CEST	192.168.2.5	1.1.1.1	0xa4d7	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Sep 2, 2024 17:01:32.922560930 CEST	192.168.2.5	1.1.1.1	0xc111	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:52.946901083 CEST	192.168.2.5	1.1.1.1	0x37f5	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Sep 2, 2024 17:01:53.257189989 CEST	192.168.2.5	1.1.1.1	0xd676	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:02:13.259567022 CEST	192.168.2.5	1.1.1.1	0x4d0d	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Sep 2, 2024 17:02:13.267452955 CEST	192.168.2.5	1.1.1.1	0x4d3	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:02:54.765754938 CEST	192.168.2.5	1.1.1.1	0x556a	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 2, 2024 17:01:12.894134998 CEST	1.1.1.1	192.168.2.5	0x9eac	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:12.894134998 CEST	1.1.1.1	192.168.2.5	0x9eac	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:12.894134998 CEST	1.1.1.1	192.168.2.5	0x9eac	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:12.894134998 CEST	1.1.1.1	192.168.2.5	0x9eac	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:16.051440001 CEST	1.1.1.1	192.168.2.5	0x8151	No error (0)	vanaheim.cn	77.232.41.29	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:32.921876907 CEST	1.1.1.1	192.168.2.5	0xa4d7	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 2, 2024 17:01:32.921876907 CEST	1.1.1.1	192.168.2.5	0xa4d7	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 2, 2024 17:01:32.921876907 CEST	1.1.1.1	192.168.2.5	0xa4d7	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 2, 2024 17:01:32.932095051 CEST	1.1.1.1	192.168.2.5	0xc111	No error (0)	mta7.am0.yahoodns.net	67.195.204.77	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:32.932095051 CEST	1.1.1.1	192.168.2.5	0xc111	No error (0)	mta7.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:32.932095051 CEST	1.1.1.1	192.168.2.5	0xc111	No error (0)	mta7.am0.yahoodns.net	67.195.228.110	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:32.932095051 CEST	1.1.1.1	192.168.2.5	0xc111	No error (0)	mta7.am0.yahoodns.net	67.195.228.109	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:32.932095051 CEST	1.1.1.1	192.168.2.5	0xc111	No error (0)	mta7.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:32.932095051 CEST	1.1.1.1	192.168.2.5	0xc111	No error (0)	mta7.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:32.932095051 CEST	1.1.1.1	192.168.2.5	0xc111	No error (0)	mta7.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:32.932095051 CEST	1.1.1.1	192.168.2.5	0xc111	No error (0)	mta7.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:53.256279945 CEST	1.1.1.1	192.168.2.5	0x37f5	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Sep 2, 2024 17:01:53.267031908 CEST	1.1.1.1	192.168.2.5	0xd676	No error (0)	smtp.google.com	64.233.184.26	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:53.267031908 CEST	1.1.1.1	192.168.2.5	0xd676	No error (0)	smtp.google.com	74.125.206.27	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:53.267031908 CEST	1.1.1.1	192.168.2.5	0xd676	No error (0)	smtp.google.com	74.125.206.26	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:53.267031908 CEST	1.1.1.1	192.168.2.5	0xd676	No error (0)	smtp.google.com	142.251.173.26	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:01:53.267031908 CEST	1.1.1.1	192.168.2.5	0xd676	No error (0)	smtp.google.com	142.251.173.27	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:02:13.266614914 CEST	1.1.1.1	192.168.2.5	0x4d0d	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Sep 2, 2024 17:02:13.325735092 CEST	1.1.1.1	192.168.2.5	0x4d3	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:02:13.325735092 CEST	1.1.1.1	192.168.2.5	0x4d3	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:02:54.774537086 CEST	1.1.1.1	192.168.2.5	0x556a	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:02:54.774537086 CEST	1.1.1.1	192.168.2.5	0x556a	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:02:54.774537086 CEST	1.1.1.1	192.168.2.5	0x556a	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Sep 2, 2024 17:02:54.774537086 CEST	1.1.1.1	192.168.2.5	0x556a	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:00:48
Start date:	02/09/2024
Path:	C:\Users\user\Desktop\bEsOrli29K.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bEsOrli29K.exe"
Imagebase:	0x400000
File size:	218'624 bytes
MD5 hash:	A3247152E18BA6E88311F082A86515D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.2140290785.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2181701002.000000000069A000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:00:58
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\edgikboy\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:00:58
Start date:	02/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:00:59
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe" C:\Windows\SysWOW64\edgikboy\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:00:59
Start date:	02/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:00:59
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create edgikboy binPath= "C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d\"C:\Users\user\Desktop\bEsOrli29K.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xa90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:00:59
Start date:	02/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:01:00
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description edgikboy "wifi internet conection"
Imagebase:	0xa90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:01:00
Start date:	02/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:01:00
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start edgikboy
Imagebase:	0xa90000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:01:00
Start date:	02/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:01:00
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe /d"C:\Users\user\Desktop\bEsOrli29K.exe"
Imagebase:	0x400000
File size:	14'984'704 bytes
MD5 hash:	A0F884B02EE655DEE8140FACC411FA01
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2281554914.0000000000623000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000003.2279300378.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2281500674.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:01:01
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:01:01
Start date:	02/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:01:01
Start date:	02/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	11:01:01
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5344 -ip 5344
Imagebase:	0x70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:01:01
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 1032
Imagebase:	0x70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:01:11
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x790000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	11:01:11
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5496 -ip 5496
Imagebase:	0x70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:01:11
Start date:	02/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 392
Imagebase:	0x70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:01:34
Start date:	02/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	2.2%
Signature Coverage:	25.8%
Total number of Nodes:	1598
Total number of Limit Nodes:	28

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

%X%08X, xrefs: 0040A0B0
D, xrefs: 00409F8E
", xrefs: 00409EDB
", xrefs: 0040A189
P, xrefs: 00409DAA
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 0040A078
\, xrefs: 00409D0C

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 004250B9 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 271
memorywindowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,00000000), ref: 00425148
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00425154
GetActiveWindow.USER32 ref: 0042515A
LoadIconA.USER32(00000000,00000000), ref: 00425162
InflateRect.USER32(00000000,00000000,00000000), ref: 0042516F
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 00425178
GetAtomNameA.KERNEL32(00000000,?,00000000), ref: 00425185
InitAtomTable.KERNEL32(00000000), ref: 0042518C
GetCurrentConsoleFont.KERNEL32(00000000,00000000,?), ref: 00425199
DebugBreak.KERNEL32 ref: 0042519F
EnumDateFormatsW.KERNEL32(00000000,00000000,00000000), ref: 004251A8
SetCommMask.KERNELBASE(00000000,00000000), ref: 004251D9
GetTickCount.KERNEL32 ref: 004251DF
GetDateFormatA.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 00425203
GetSystemTimes.KERNELBASE(?,?,?), ref: 00425218
FoldStringA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0042523E
GetTimeFormatA.KERNEL32(00000000,00000000,0042C4E0,0042C4E0,?,00000000), ref: 0042527F
HeapLock.KERNEL32(00000000), ref: 00425286
FormatMessageW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0042529A
GlobalAlloc.KERNELBASE(00000000), ref: 00425338
LoadLibraryA.KERNELBASE(0042C520), ref: 0042537B
VirtualProtect.KERNELBASE(00000040,?), ref: 00425394
GetProcessIoCounters.KERNEL32(00000000,00000000), ref: 004253AC
UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004253B7

Strings

}$, xrefs: 004253CB
k`, xrefs: 004253BD

Memory Dump Source

Source File: 00000000.00000002.2181031656.0000000000418000.00000020.00000001.01000000.00000003.sdmp, Offset: 00418000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_418000_bEsOrli29K.jbxd

Similarity

API ID: Format$AtomDateLoad$ActiveAllocBreakCacheCommConsoleCountCountersCurrentDebugEnumExchangeFileFlushFoldFontFormatsGlobalHeapIconInflateInitInstructionInterlockedLibraryLockMaskMessageNameProcessProtectRectStringSystemTableTickTimeTimesUnlockVirtualWindowlstrcat
String ID: k`$}$
API String ID: 1758670013-956986773
Opcode ID: 11a06e5e142067575ebe82f8eff95b9e5a09bdf74230d629ed085f9a8f10a717
Instruction ID: 06bb82473ef69684721e713d6b0dfcdbaab8e4b9c375e17e3125242d7fe09b8c
Opcode Fuzzy Hash: 11a06e5e142067575ebe82f8eff95b9e5a09bdf74230d629ed085f9a8f10a717
Instruction Fuzzy Hash: 6E81E671602A30BBC225AB62FC49DAF7B6CFF4A355B40103AF545D21A1D7389542CBEE

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID: PromptOnSecureDesktop
API String ID: 3188212458-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 0069B00E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0069B036
Module32First.KERNEL32(00000000,00000224), ref: 0069B056

Memory Dump Source

Source File: 00000000.00000002.2181701002.000000000069A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0069A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69a000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: a035c155b476cc2a52b3904ca2342c434184e22c435fb999ffe7eed2c7503eb1
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 34F0F631200310AFDB203BF4AD8DBAF76EEAF48324F101528E652929C0DBB0EC458A61

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 0054003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0054024D

Strings

cess, xrefs: 0054018D
kernel32.dll, xrefs: 0054008F, 00540095

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 154a888089c45a34402e680f3c48991356cd843d6438e7c360382ace7e0c66c3
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: F0526974A01229DFDB64CF58C984BA8BBB1BF09304F1480D9E54DAB291DB30AE95DF15

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 00406DC2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Strings

xa,, xrefs: 00406E06

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID: xa,
API String ID: 1823874839-1065553563
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 00540E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00540223,?,?), ref: 00540E19
SetErrorMode.KERNELBASE(00000000,?,?,00540223,?,?), ref: 00540E1E

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 8c4bb27ebef91340a8cc9f03cc0e2f213876f804ecf9a794f7e7c0ac875d06d5
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 5FD0123114512877D7002A94DC09BCD7F1CDF05B66F108411FB0DD9080C770995046E5

Function 0069ACCD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0069AD1E

Memory Dump Source

Source File: 00000000.00000002.2181701002.000000000069A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0069A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69a000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ee75654346c1d103995654828f2838917bd8b1f15b90b8e2e7523cc4946d9345
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: DF113C79A00208EFDB01DF98C985E98BBF5EF08351F158094F9489B362D371EA50DF81

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

srv_time, xrefs: 0040CABB
@, xrefs: 0040D754
4, xrefs: 0040D9F7
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
local_time, xrefs: 0040CACD
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
\, xrefs: 0040D39D
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
wtm_c, xrefs: 0040C956
\, xrefs: 0040D3A7
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
.sys, xrefs: 0040D0CC
flags_upd, xrefs: 0040CE4A
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
lid_file_upd, xrefs: 0040CE6A
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
wtm_r, xrefs: 0040C97F
wtm_w, xrefs: 0040C96C
drivers\, xrefs: 0040D067

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlFreeSid, xrefs: 00401116
RtlLengthSid, xrefs: 00401246
NtTerminateProcess, xrefs: 004010F6
RtlNtStatusToDosError, xrefs: 00401194
ntdll.dll, xrefs: 0040100D
NtOpenProcessToken, xrefs: 004011D4
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtSetInformationThread, xrefs: 00401155
NtQueryInformationToken, xrefs: 00401262
NtFilterToken, xrefs: 0040122B
RtlInitUnicodeString, xrefs: 00401135
NtDuplicateToken, xrefs: 004011F3
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtClose, xrefs: 004011B4
NtSetInformationToken, xrefs: 00401175
RtlSetLastWin32Error, xrefs: 004010D6

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Sep, xrefs: 0040B28E
Dec, xrefs: 0040B2A3
Nov, xrefs: 0040B29C
Mon, xrefs: 0040B22C
Jul, xrefs: 0040B280
Fri, xrefs: 0040B248
Jun, xrefs: 0040B279
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Wed, xrefs: 0040B23A
Oct, xrefs: 0040B295
Feb, xrefs: 0040B25D
Sat, xrefs: 0040B24F
Apr, xrefs: 0040B26B
Tue, xrefs: 0040B233
Sun, xrefs: 0040B225
May, xrefs: 0040B272
Aug, xrefs: 0040B287
Mar, xrefs: 0040B264
Jan, xrefs: 0040B256
Thu, xrefs: 0040B241

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

<, xrefs: 00401378
@, xrefs: 00401380
D, xrefs: 004015C6
, xrefs: 00401462
PDGu, xrefs: 0040139A
useless, xrefs: 0040161E
%systemroot%\system32\cmd.exe, xrefs: 00401316
wusa.exe, xrefs: 00401388
uac, xrefs: 00401628

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

kernel32, xrefs: 00401DF7
IsWow64Process, xrefs: 00401DF2
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
work_srv, xrefs: 00401E5E
born_date, xrefs: 00401EAD, 00401ECC
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
start_srv, xrefs: 00401E6C
lid_file_upd, xrefs: 00401E25
net_type, xrefs: 00401E87
loader_id, xrefs: 00401F4B, 00401F6B
hi_id, xrefs: 00401F16, 00401F1B, 00401F33

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 005465E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 005465F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00546610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 00546631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 00546652

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 4c258c7a41499e36644c5167fd510dc528da2edf0034e13745af275805d7fe81
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: EF1191B1600219BFDB219F65EC0AFDB3FA8FB457A9F114024F908A7251DBB1DD0086A5

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 0054092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 005409DC, 005409DF, 005409E4
l, xrefs: 00540966
., xrefs: 0054095F

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 1ac6c022222df10fddb45b89cce92d0bd369c4a3ad6ba39bd49a2e21b0455d6a
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: EB318AB6910609CFDB10CF99C880AEEBBF9FF48328F24504AD941A7351D771EA45CBA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 0069A8EB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181701002.000000000069A000.00000040.00000020.00020000.00000000.sdmp, Offset: 0069A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69a000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 784afc855bcd13ab5c84581519becdd3e049072cd1421be4c0b3bafcefd739f7
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 4A117072350100AFDB44DF95DC81FA673EEFB89360B2A8055ED04CB716D675E802C7A0

Function 00540D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 2c82bd516d6ff097f8176106e61eb0d6ffe2c8492c1e619661976ec5e8f84ee2
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: B801D472A006008FDB21DF60C804BEA37B9FB85309F1544A4DA0697282E370A9458B80

Function 00549EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00549E6D
lstrcpy.KERNEL32(?,00000000), ref: 00549FE1
lstrcat.KERNEL32(?,?), ref: 00549FF2
lstrcat.KERNEL32(?,0041070C), ref: 0054A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0054A054
DeleteFileA.KERNEL32(?), ref: 0054A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0054A0D6
lstrcpy.KERNEL32 ref: 0054A12F
lstrlen.KERNEL32(00000022), ref: 0054A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 00549F13

Part of subcall function 00547029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 00547081

Part of subcall function 00546F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\utwyareo,00547043), ref: 00546F4E
Part of subcall function 00546F30: GetProcAddress.KERNEL32(00000000), ref: 00546F55
Part of subcall function 00546F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00546F7B
Part of subcall function 00546F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00546F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0054A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0054A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0054A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0054A21B
GetDriveTypeA.KERNEL32(?), ref: 0054A265
lstrcat.KERNEL32(?,00000000), ref: 0054A29F
lstrcat.KERNEL32(?,00410A34), ref: 0054A2C5
lstrcat.KERNEL32(?,00000022), ref: 0054A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0054A2F4
wsprintfA.USER32 ref: 0054A31D
lstrcat.KERNEL32(?,00000000), ref: 0054A345
lstrcat.KERNEL32(?,?), ref: 0054A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0054A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0054A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0054A1D1

Part of subcall function 00549966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0054999D
Part of subcall function 00549966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 005499BD
Part of subcall function 00549966: RegCloseKey.ADVAPI32(?), ref: 005499C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0054A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0054A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0054A41D

Strings

P, xrefs: 0054A011
", xrefs: 0054A2DF
D, xrefs: 0054A1F5
\, xrefs: 00549F73
", xrefs: 0054A3F0
", xrefs: 0054A142

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 9a727131086402e8a26a032c3a533df0b8b7f77d02aea8ca227b5499c9afb06e
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: D0F130B1C40259AFDF21DFA08C49EEF7BBCBB48308F5444A6F609E2141E7758A848F65

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00547CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00547D21
GetUserNameA.ADVAPI32(?,?), ref: 00547D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00547D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00547DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00547DC0
EqualSid.ADVAPI32(?,?), ref: 00547DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 00547DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00547DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00547E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00547E12
LocalFree.KERNEL32(00000000), ref: 00547E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00547E35

Strings

D, xrefs: 00547D73
PromptOnSecureDesktop, xrefs: 00547FA0

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 5adf81cff110d09f516cc4b6d65a8cf1364b92f88b186fcfa56755949861d1e3
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 3DA13B7190021DAFDB118FA0DD88FEEBFBDFB48304F14816AE605E6150EB758A95CB64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

plgs:, xrefs: 004066AA
localcfg, xrefs: 0040672D
%d=%p, xrefs: 004066F9
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
12:08:32, xrefs: 00406535
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
except_info, xrefs: 00406728
Jan 13 2018, xrefs: 0040653A
va=%08X%08X uef=%p, xrefs: 00406595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

ESMTP, xrefs: 0040AA38
localcfg, xrefs: 0040AB0B
ehlo %s, xrefs: 0040A7F5
mail from:<%s>, xrefs: 0040A848
helo %s, xrefs: 0040A803
rcpt to:<%s>, xrefs: 0040A855
Too small respons, xrefs: 0040A9C9
Too big smtp respons (%d bytes), xrefs: 0040A9B1
., xrefs: 0040A8CA
quit, xrefs: 0040A86C
data, xrefs: 0040A85E
AUTH LOGIN, xrefs: 0040A80C
Incorrect respons, xrefs: 0040AB39
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00547A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00547A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00547ACD
GetLengthSid.ADVAPI32(?), ref: 00547ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00547B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00547B1F
EqualSid.ADVAPI32(?,?), ref: 00547B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 00547B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00547B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00547B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00547B77
LocalFree.KERNEL32(00000000), ref: 00547B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00547B9A
GetAce.ADVAPI32(?,?,?), ref: 00547BCA
EqualSid.ADVAPI32(?,?), ref: 00547BF1
DeleteAce.ADVAPI32(?,?), ref: 00547C0A
EqualSid.ADVAPI32(?,?), ref: 00547C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 00547CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00547CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00547CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00547CE0
LocalFree.KERNEL32(00000000), ref: 00547CEE

Strings

D, xrefs: 00547AC3

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 57ab21ca0a8df4b7e67b746cfaae047ada5b0e3625585e843c32fd3145e1fa79
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 79813B7190421DABDB11CFA4DD88BEEBFB8FF0C308F04806AE515E6150D7759A41CBA4

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetAdaptersInfo, xrefs: 004019DC
GetBestInterface, xrefs: 004019EF
GetIfEntry, xrefs: 004019E4
localcfg, xrefs: 004019A3
123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 0054858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0054865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0054867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 005486A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 005486B1

Strings

PromptOnSecureDesktop, xrefs: 005485B6, 00548645, 005486BD, 00548708, 005487C5, 00548812, 005488E9, 00548905
", xrefs: 0054896C

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: f5f39e8f84c78405caa5a79986c2dab7b6f3de14f287b3f6ab7abb0da96e307e
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: C2C1B071900209BEEB11ABA4DC89EFF7FBCFB58308F144476F605E2051EBB14A949B65

Function 005414E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00541601
lstrlenW.KERNEL32(-00000003), ref: 005417D8

Strings

@, xrefs: 005415E7
D, xrefs: 0054182D
<, xrefs: 005415DF
, xrefs: 005416C9

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 0c4a1a3928f5332ac33e4b4e253cfbe2eb2bd5d068b05a73adbe6b65d88044ef
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 3EF18DB15087419FD720CF64C888BEBBBE4FB88308F10892DF59697290D7B4D984CB5A

Function 00547666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 005476D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00547757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0054778F
___ascii_stricmp.LIBCMT ref: 005478B4
RegCloseKey.ADVAPI32(?), ref: 0054794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0054796D
RegCloseKey.ADVAPI32(?), ref: 0054797E
RegCloseKey.ADVAPI32(?), ref: 005479AC
RegCloseKey.ADVAPI32(?), ref: 00547A56

Part of subcall function 0054F40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,0054772A,?), ref: 0054F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 005479F6
RegCloseKey.ADVAPI32(?), ref: 00547A4D

Strings

", xrefs: 00547800
PromptOnSecureDesktop, xrefs: 005476C5, 005476CA, 005476E5, 00547782, 005477E6, 00547862, 0054787B, 005479C2

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 5f18f2415cbcfdc631bca6cf4873e9ece24ccd06ac0483057c3eb866cdf98e7d
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 92C1827290420EAFEB219FA4DC49FEE7FB9FF89314F1040A5F544E6151EB719A848B60

Function 00542CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00542CED
socket.WS2_32(00000002,00000002,00000011), ref: 00542D07
htons.WS2_32(00000000), ref: 00542D42
select.WS2_32 ref: 00542D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 00542DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00542E62

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 7172c50ddcff244c9ac3b68c0eebda80e0bbfc424ea0678f2a3c8d5db52ca5dc
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 7F61E371904326ABC3209F65CC09BBBBFF8FF84349F914819F94497151D7B4D8848BA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_MID, xrefs: 0040AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_HST, xrefs: 0040AEC5
127.0.0.1, xrefs: 0040ADEB
%s%d, xrefs: 0040AE58
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0054958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 005495A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005495D5
GetModuleFileNameA.KERNEL32(00000000), ref: 005495DC
wsprintfA.USER32 ref: 00549635
wsprintfA.USER32 ref: 00549673
wsprintfA.USER32 ref: 005496F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00549758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0054978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 005497D8

Strings

PromptOnSecureDesktop, xrefs: 00549604, 00549624, 00549662, 00549683, 005496B6, 005496DF, 00549701, 00549734, 00549780, 005497B7

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 6f25e8b9c30bdb78c19925ffe84e753cd7dca432892bd9bf8adfedad29c98ee8
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 2AA16BB1900209ABEB21DFA4CC4AFDB3FACFB45745F204026FA1596152E7B5D984CBA4

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

06A, xrefs: 0040BF70
86A, xrefs: 0040BF98
46A, xrefs: 0040BF85
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_USER, xrefs: 0040B488
%M5DATE, xrefs: 0040B50F
%DATE, xrefs: 0040B4D2
%TO_DOMAIN, xrefs: 0040B44B
%s@%s, xrefs: 0040B461
%FROM_DOMAIN, xrefs: 0040B41E
%TO_EMAIL, xrefs: 0040B473
%FROM_USER, xrefs: 0040B431
%TO_HASH, xrefs: 0040B4B0
%FROM_EMAIL, xrefs: 0040B3E9
%P5DATE, xrefs: 0040B4F2

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00541FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0054202D
GetSystemInfo.KERNEL32(?), ref: 0054204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 0054206A
GetProcAddress.KERNEL32(00000000), ref: 00542071
GetCurrentProcess.KERNEL32(?), ref: 00542082
GetTickCount.KERNEL32 ref: 00542230

Part of subcall function 00541E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 00541E7C

Strings

hi_id, xrefs: 0054217D, 00542182, 0054219A
work_srv, xrefs: 005420C5
flags_upd, xrefs: 005420A5, 005420AA, 005420E3
localcfg, xrefs: 00542091, 00542098, 005420AB, 005420E4, 005420F3, 00542119, 00542138, 0054214E, 00542166, 00542183, 0054219B, 005421B7, 005421D7

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 26e74fde23c86c3706efda5290e3e6fa409d145468db017059d5625aa3fcdc19
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: E551C5B05043456FE330AF758C8AFA7BEECFB84708F40491DF99682142D7B5A984C765

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 00543059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00543068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00543078
GetProcAddress.KERNEL32(00000000,00410408), ref: 00543095
RtlAllocateHeap.NTDLL(00000000), ref: 005430B6
htons.WS2_32(00000035), ref: 005430EF
inet_addr.WS2_32(?), ref: 005430FA
gethostbyname.WS2_32(?), ref: 0054310D
HeapFree.KERNEL32(00000000), ref: 0054314D

Strings

iphlpapi.dll, xrefs: 00543062, 00543067, 00543077

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 9f846563e26b71c42376995f3b593efdc1db0701943744de08e7e7f9801d5a37
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 50318631A00606ABDB119BB89C48AEE7FB8FF04764F144265F518E72A0DB74DE81CB58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00546778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 005467C3
htonl.WS2_32(?), ref: 005467DF
htonl.WS2_32(?), ref: 005467EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 005468F1
ExitProcess.KERNEL32 ref: 005469BC

Strings

localcfg, xrefs: 00546994
except_info, xrefs: 0054698F

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 4dff4b95dc44f5f97e5c81cc474de35de4e4010c6cb388f0bf01291133ff03f4
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: FA618072940208AFDB609FB4DC45FEA7BE9FF48304F148066F96DD2161DAB59990CF14

Function 0054F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0054CC84), ref: 0054F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0054F5CE
closesocket.WS2_32(00000000), ref: 0054F5DC

Strings

time_cfg, xrefs: 0054F58A

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 5420c4ab8c3977bf513e77a20ab30260b5ffc4aedb87511255aa90f8d0273f55
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 97317A72900119ABDB10DFA9EC89DEF7BBCFF88314F114566F905E3150E7708A818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 00542F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00542FA1
LoadLibraryA.KERNEL32(?), ref: 00542FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00542FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00543000
RtlAllocateHeap.NTDLL(00000000), ref: 00543007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 00543032

Strings

dnsapi.dll, xrefs: 00542F90

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 6e2670cdad0fcee6640ff8199cfdc034dcf3ae266de98778da712e48909de33c
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 6A21C171900229BBCB219B95DC49AEEBFBCFF08B14F404421F905E3150D7B09E8587E0

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 00546F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\utwyareo,00547043), ref: 00546F4E
GetProcAddress.KERNEL32(00000000), ref: 00546F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00546F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00546F92

Strings

C:\Windows\SysWOW64\, xrefs: 00546F30, 00546F38, 00546F65, 00546F6C, 00546F7A, 00546F85, 00546F91, 00546FA9, 00546FC6, 00546FEC
\\.\pipe\utwyareo, xrefs: 00546F37
PromptOnSecureDesktop, xrefs: 00546F9D, 00546FBF, 00546FCF, 00546FE5, 00546FF5

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\utwyareo
API String ID: 1082366364-2671325736
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: ba6201c575b6e60445dfe136d27f94753a6fc014373c56a915033ec541662e67
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: A62126317453457AF7225335AC8DFFB2E4CAB97718F1840A5F448E6081DBD988DA826E

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 005492CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 005492E2
wsprintfA.USER32 ref: 00549350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00549375
lstrlen.KERNEL32(?,?,00000000), ref: 00549389
WriteFile.KERNEL32(00000000,?,00000000), ref: 00549394
CloseHandle.KERNEL32(00000000), ref: 0054939B

Strings

PromptOnSecureDesktop, xrefs: 0054932B, 00549343, 0054935E

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 662cdeba73e4fec61cbf9c2edc4810c8a896a669da597112eee5f7060ab3edd2
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 431193B27401157BE7216B32EC0EFEF3E6DEBC9B14F00C065BB09E5091EEB44A4586A4

Function 005499E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00549A18
GetThreadContext.KERNEL32(?,?), ref: 00549A52
TerminateProcess.KERNEL32(?,00000000), ref: 00549A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00549A98
SetThreadContext.KERNEL32(?,00010002), ref: 00549AB5
ResumeThread.KERNEL32(?), ref: 00549AC2

Strings

D, xrefs: 00549A10

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: bda3f207350c6701ad24b1deed2289853a47859025defb9df01985dd098acd2e
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 45213BB1A01219BBDB11DBA1DC0AEEFBFBCFF05754F404461BA19E1150E7758A84CBA4

Function 00541C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00541C18
LoadLibraryA.KERNEL32(004102C8), ref: 00541C26
GetProcessHeap.KERNEL32 ref: 00541C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00541C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00541CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 00541D02
FreeLibrary.KERNEL32(?), ref: 00541D0B

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: ca20fcaad073cb3081624eb756777627be6714b2c56cd8a5dd0f6e318882a373
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 2D315872E00209BFCB119FA4DD888EEBFB9FB45305B24447AE501A6110D7B54EC0DB98

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00546CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00546CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00546D22
GetLastError.KERNEL32 ref: 00546DA7
CloseHandle.KERNEL32(?), ref: 00546DB5
GetLastError.KERNEL32 ref: 00546DD6
DeleteFileA.KERNEL32(?), ref: 00546DE7
GetLastError.KERNEL32 ref: 00546DFD

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: f898e12eaf55c9d3aebf21b4d56760a9e5310d826d86f4c152e98589239ed978
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 3B310376E00249BFCB01DFA4DD49BDE7FB9FB89304F148066E211E3211D7708A558B62

Function 0054E2FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0054E50A,00000000,00000000,00000000,00020106,00000000,0054E50A,00000000,000000E4), ref: 0054E319
RegSetValueExA.ADVAPI32(0054E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0054E38E
RegDeleteValueA.ADVAPI32(0054E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,DT), ref: 0054E3BF
RegCloseKey.ADVAPI32(0054E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,DT,0054E50A), ref: 0054E3C8

Strings

DT, xrefs: 0054E2FC
PromptOnSecureDesktop, xrefs: 0054E33A

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop$DT
API String ID: 2667537340-1980669561
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 5c3dc798e4dbadf5913ad1264f54004bfe31e38478d30a8bd56635730715410d
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: C5217A31A0021DABDF219FA4EC8AEEE7F78FF08754F008461F904A7051E6719A54D7A0

Function 00424F61 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 00424F8B
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00424FC7
GetComputerNameA.KERNEL32(?,?), ref: 00424FDB
SetCalendarInfoW.KERNEL32(00000000,00000000,00000000,0042C41C), ref: 00424FE9
OpenJobObjectA.KERNEL32(00000000,00000000,0042C428), ref: 00424FF6

Strings

-, xrefs: 00425003

Memory Dump Source

Source File: 00000000.00000002.2181031656.0000000000418000.00000020.00000001.01000000.00000003.sdmp, Offset: 00418000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_418000_bEsOrli29K.jbxd

Similarity

API ID: NodeNuma$CalendarComputerHighestInfoNameNumberObjectOpenProcessor
String ID: -
API String ID: 3293808458-2547889144
Opcode ID: cbd7c5c07cb5078078958f77ac79951bebb201362ab674e3885adec3f36132ee
Instruction ID: 0eccb1aac1e8823434b1d3e5e9d8e26066e9430f249d9380e5c281313551a7e7
Opcode Fuzzy Hash: cbd7c5c07cb5078078958f77ac79951bebb201362ab674e3885adec3f36132ee
Instruction Fuzzy Hash: 1C11D271600228EFCB21AF21ED8499F7BB8FB84318F408179E629A6141C7385A86CF5C

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 005493AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005493C6
GetModuleFileNameA.KERNEL32(00000000), ref: 005493CD
CharToOemA.USER32(?,?), ref: 005493DB
wsprintfA.USER32 ref: 00549410

Part of subcall function 005492CB: GetTempPathA.KERNEL32(00000400,?), ref: 005492E2
Part of subcall function 005492CB: wsprintfA.USER32 ref: 00549350
Part of subcall function 005492CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00549375
Part of subcall function 005492CB: lstrlen.KERNEL32(?,?,00000000), ref: 00549389
Part of subcall function 005492CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 00549394
Part of subcall function 005492CB: CloseHandle.KERNEL32(00000000), ref: 0054939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00549448

Strings

PromptOnSecureDesktop, xrefs: 005493FA, 005493FF, 0054941C

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 8f1a7eb98c1fa0d9188652d1999987236cd74927189a621131695c4ba0293cb2
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 5E0140F69001197BDB21A7619D4DEDF3A7CEB95705F0040A1BB49E2080EAB496C58F75

Function 0054AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0054AAE5

Strings

, xrefs: 0054ABB3
localcfg, xrefs: 0054AD72

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: a2d4120085c9aaeb27aba208afef607da02f81f43e8ccb5236991e8bda771f8c
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 1E713A71EC4305AAEFA18B58DCCAFEE3F69FB4030DF244426F905A6091DA628D848757

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 0054E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0054DF6C: GetCurrentThreadId.KERNEL32 ref: 0054DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0054E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00546128), ref: 0054E950
lstrcmp.KERNEL32(?,00000008), ref: 0054E989

Strings

A, xrefs: 0054E9A0
A, xrefs: 0054E960, 0054E965
A, xrefs: 0054E8C6, 0054E8CD, 0054E936, 0054E998

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: b724df5db8f150b3be6baee57d4bd19f313b1bef7903e1e7e41d047061c7659f
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: B2319C31600716EBDF718F24C88ABE67FE4FB05728F10892AF59687691D370E884CB91

Function 00546E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00546E19

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 50c0a97f685af91ffd22bc8c7e487fcadba3bfcfb328c3d517538f8ca8780da8
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 2E214D76504116BFDB109B60FC49EDF3FEDFB4A368B208425F502D1091EB719A50A675

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 0054C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0054C6B4
InterlockedIncrement.KERNEL32(0054C74B), ref: 0054C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0054C747), ref: 0054C728
CloseHandle.KERNEL32(00000000,?,0054C747,00413588,00548A77), ref: 0054C733

Strings

localcfg, xrefs: 0054C544

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: e98b25cd3b1099ad0de276aa7a25427da79b06ae209d005b1bed884115d59f02
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: FD514BB1A02B418FD7B49F69C58556ABFE9FB88304B51593EE18BC7AA0D774F8408B10

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 005471C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005471E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00547228
LocalFree.KERNEL32(?,?,?), ref: 00547286
wsprintfA.USER32 ref: 0054729D

Strings

|, xrefs: 0054721A

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 6abe6fff1d54450d8cb5dae785b1e1670498517370d2652fd83accba0a755ca8
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: C5313A76904209BBDB01DFA8DC49ADA3FACFF08314F148166F859DB201EB75DA48CB94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0054B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0054B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0054B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0054B548
GetTimeZoneInformation.KERNEL32(?), ref: 0054B590
wsprintfA.USER32 ref: 0054B61E

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: c70564c24516ee4d33e7e247abea569c49a16d98e3b70424e38065adb0ff1eb9
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 075142B1D0021CAADF14DFD4D8885EEFBB9BF48304F10812AF501A6150E7B88AC9CF94

Function 005462D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 00546303
LoadLibraryA.KERNEL32(?), ref: 0054632A
GetProcAddress.KERNEL32(00000000,?), ref: 005463B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 00546405

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 08db78cefe3d4f60986abb5ece1cabc2c9cc493d7d4e894c6b91515396fc26f9
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 85415BB1A0020AAFDF14CF58C884BE9BBB8FF05358F248969E815D7290E771ED40DB51

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 0054E3DE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,DT,00000000,00000000,00000000), ref: 0054E470
CloseHandle.KERNEL32(00000001,00000003), ref: 0054E484

Part of subcall function 0054E2FC: RegCreateKeyExA.ADVAPI32(80000001,0054E50A,00000000,00000000,00000000,00020106,00000000,0054E50A,00000000,000000E4), ref: 0054E319
Part of subcall function 0054E2FC: RegSetValueExA.ADVAPI32(0054E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0054E38E
Part of subcall function 0054E2FC: RegDeleteValueA.ADVAPI32(0054E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,DT), ref: 0054E3BF
Part of subcall function 0054E2FC: RegCloseKey.ADVAPI32(0054E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,DT,0054E50A), ref: 0054E3C8

Strings

DT, xrefs: 0054E498, 0054E4BD, 0054E41A, 0054E447, 0054E4C0, 0054E41D, 0054E459, 0054E45A, 0054E46C, 0054E49B
PromptOnSecureDesktop, xrefs: 0054E4F1, 0054E4F6, 0054E537, 0054E561

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop$DT
API String ID: 4151426672-1980669561
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 92aced4d27436c113832870fbf999f93538012ba920e6c4a8597f2ea036e5990
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: A241D6B6900215BAEF206B518C4BFEF3F6CFF4472CF148065FA0994092E7B58A50DAB4

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 0054E795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0054DF6C: GetCurrentThreadId.KERNEL32 ref: 0054DFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,0054A6AC), ref: 0054E7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,0054A6AC), ref: 0054E7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,0054A6AC), ref: 0054E819

Strings

PromptOnSecureDesktop, xrefs: 0054E840, 0054E845, 0054E87C, 0054E89B

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 2a92920d74a71820abdf2b256ac2be287b41d9edd189de1bd9682a838e3a34b1
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 8021F9B1A403027AF62077219C0FFEB3E1CFBA5768F500034FA0AB51D3FA55985086B5

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00547665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 005476D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0054796D
RegCloseKey.ADVAPI32(?), ref: 0054797E

Strings

PromptOnSecureDesktop, xrefs: 005476C5, 005476CA, 005476E5

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: de7d9cb3a3be5376cbbcd1f814f32d3a3c47cbc5fa7e2a09bf119c4e9cc91216
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 9911EE70A04109AFDB118FA9EC49FEFBF79FB89308F150561F515EA291E3B08D408B60

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 00549966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0054999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 005499BD
RegCloseKey.ADVAPI32(?), ref: 005499C6

Strings

PromptOnSecureDesktop, xrefs: 00549989, 0054998E, 005499B0, 005499D3

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 29a7463438f8ae83a899204ffa117b7487d102bc83a079b2086cf251c0b7c813
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: D6F096B2680218BBF7116B54EC0BFDB3E2CEB95B14F504075FA05B5092F6E59E9082F9

Function 005428EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 005428FA
gethostbyname.WS2_32(u6A), ref: 00542906

Strings

time_cfg, xrefs: 005428EB
u6A, xrefs: 005428EC, 005428F9, 00542905

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 83b2ddce7cc79ee651171a814c67ba1828611c854ff77881390cb5570a4fea66
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: E6E082306082218FDB008B28F848ADA3BA4AF0A334F428180F080C32A1C7349CC0AA88

Function 005469C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 005469E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 00546A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 00546A3A
CloseHandle.KERNEL32(000000FF), ref: 00546BD8

Part of subcall function 0054EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00541DCF,?), ref: 0054EEA8
Part of subcall function 0054EE95: HeapFree.KERNEL32(00000000), ref: 0054EEAF

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 44e68c456ef2cdfe4ba11c63e3dec3fe93bc06b340ee957740147b036de0796d
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: EC71257190021DEFDF109FA4CC84AEEBFB9FB05318F10856AE515E6190D7349E92DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 00425028 Relevance: 6.0, APIs: 4, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetFullPathNameA.KERNEL32(00000000,00000000,?,00000000), ref: 0042505E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042507A
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00425098
SetFileShortNameA.KERNEL32(00000000,0042C460), ref: 004250A4

Memory Dump Source

Source File: 00000000.00000002.2181031656.0000000000418000.00000020.00000001.01000000.00000003.sdmp, Offset: 00418000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_418000_bEsOrli29K.jbxd

Similarity

API ID: Name$CreateEnvironmentFileFreeFullHeapPathShortStrings
String ID:
API String ID: 4071102102-0
Opcode ID: bc69b1226fcf67db89fe464c706799af24d95d8a8024064d16ebc773a46ea2e6
Instruction ID: 5c8f484b8e6f5073547a08100acdc7810c7886e53351bf40ac3baed53192359c
Opcode Fuzzy Hash: bc69b1226fcf67db89fe464c706799af24d95d8a8024064d16ebc773a46ea2e6
Instruction Fuzzy Hash: 6E015E76701514ABC721AB66FD88D6F77BCE7C9709780102AF601D2190DA385942CAAD

Function 00425F00 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00425F26

Part of subcall function 00425D4B: __fltout2.LIBCMT ref: 00425D77

__cftog_l.LIBCMT ref: 00425F4C
__cftoe_l.LIBCMT ref: 00425F7E

Memory Dump Source

Source File: 00000000.00000002.2181031656.0000000000418000.00000020.00000001.01000000.00000003.sdmp, Offset: 00418000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_418000_bEsOrli29K.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 62ab4b8ba8e517d9559e8c491edd40464884d24b5327c3800230cc66b45608ab
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: BE11923211455EBBCF125F84ED05CEE3F22BB18354F998416FE1859130D33ACAB2AB89

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 0054417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 005441AB
GetLastError.KERNEL32 ref: 005441B5
WaitForSingleObject.KERNEL32(?,?), ref: 005441C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 005441D9

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 4a8584d75d843c6aeb69f805d14aba13ac5dac8ed65e270d58d604c271197ce5
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 9201A57691110AABDF01DF91ED84BEE7BACFB18359F108461F901E2050D7749AA4CFB6

Function 005441F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0054421F
GetLastError.KERNEL32 ref: 00544229
WaitForSingleObject.KERNEL32(?,?), ref: 0054423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0054424D

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: a95c71f21399a2b331da3081b5db22fc8b7c2af87823db42c8ea6ffade2edee2
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 1C01A572555109ABDF01DF90ED84BEF7BACFB0835AF108461F901E2050D7B09A549FB6

Function 0054E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0054E066

Strings

A, xrefs: 0054E07F
A, xrefs: 0054E036
A, xrefs: 0054E037, 0054E03C

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 9a0649f2f1ba92bd2011c6e90dd32c921ec4523ea51be81df567301d0106263a
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: BFF06231200702DBCB20CF65D888AC2BBE9FB05325B44862BE168C3060D3B4A899CB51

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 00548330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 005483C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00548477

Part of subcall function 005469C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 005469E5
Part of subcall function 005469C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 00546A26
Part of subcall function 005469C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 00546A3A

Part of subcall function 0054EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00541DCF,?), ref: 0054EEA8
Part of subcall function 0054EE95: HeapFree.KERNEL32(00000000), ref: 0054EEAF

Strings

PromptOnSecureDesktop, xrefs: 005483B2, 005483B7, 00548483

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: b705c0db7fa76178c956dcf01c84f5e631ba38f222d670f55f80157842185c18
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: EE4150B290010ABFEF10ABA49D85DFF7F6CFB44348F144466F504E6111EAB45A988B65

Function 0054E631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0054E859,00000000,00020119,0054E859,PromptOnSecureDesktop), ref: 0054E64D
RegCloseKey.ADVAPI32(0054E859,?,?,?,?,000000C8,000000E4), ref: 0054E787

Strings

PromptOnSecureDesktop, xrefs: 0054E637

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 98ae48c990cca30e7e0cd347f8e069b80f81c9d47c2a511b0f81578da6ecc390
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 7F4117B2D0011DBFDF11AF98DC86DEEBB79FB54308F104466FA00A6150E3719A559B60

Function 0054AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0054AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0054B00D

Part of subcall function 0054AF6F: gethostname.WS2_32(?,00000080), ref: 0054AF83
Part of subcall function 0054AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0054AFE6

Part of subcall function 0054331C: gethostname.WS2_32(?,00000080), ref: 0054333F
Part of subcall function 0054331C: gethostbyname.WS2_32(?), ref: 00543349

Part of subcall function 0054AA0A: inet_ntoa.WS2_32(00000000), ref: 0054AA10

Strings

%OUTLOOK_BND_, xrefs: 0054B076, 0054B07B, 0054B0BE, 0054B0DD

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 9d91a0d016586592c3c86b405a7136d2646f57e4ba345de9c8acce01493d85f6
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 47411E7290020DBBDB25EFA4DC4AEEF3BACFB48304F244426F92992152EA75D654CB54

Function 00549452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 00549536
Sleep.KERNEL32(000001F4), ref: 0054955D

Strings

, xrefs: 005494D9

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 3f9d416b05c40c911c33905187967865efc70af1bf6d641c57df850d01a81f05
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: B941F5B18043856EEF379A64D88FBE77FA4BF4231CF3441E5D48697192D6744D818711

Function 0054BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0054B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0054BA3A
InterlockedIncrement.KERNEL32(?), ref: 0054BA94
GetTickCount.KERNEL32 ref: 0054BB79
GetTickCount.KERNEL32 ref: 0054BB99
InterlockedIncrement.KERNEL32(?), ref: 0054BE15
closesocket.WS2_32(00000000), ref: 0054BEB4

Strings

%FROM_EMAIL, xrefs: 0054BC7D

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 7eecbf324de56d4bea38ede6b90606932c1f6c00ef2c6a0b29138577c9820e83
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 59319171800248DFEF25DFA4DC48AED7BB8FB88704F204466FA1482151DB31DA95CF11

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 0054709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 005470BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 005470F4

Strings

|, xrefs: 005470E6

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 3fb2e5ae59ead0c3541eb55d69716371c91ee1dc4f26b074d0513c194248c7b4
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 07112A7290411CEBDF15CBE4DD84ADEBBBCBB08305F1451A6E501F6090D7709B88CBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.2180995386.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2180995386.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 00543189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00542F88: GetModuleHandleA.KERNEL32(?), ref: 00542FA1
Part of subcall function 00542F88: LoadLibraryA.KERNEL32(?), ref: 00542FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 005431DA
HeapFree.KERNEL32(00000000), ref: 005431E1

Memory Dump Source

Source File: 00000000.00000002.2181457601.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_bEsOrli29K.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 1ba83095f042057a3fa0bcf9f45ede59f1396a151da77ebca6415de1e1aa4a6e
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 7051BC3590420AAFCF01DF68D8889FABB75FF15308F244568EC96C7221E772DA19CB90

Analysis Process: pwdgvjcm.exePID: 5496, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	0%
Total number of Nodes:	1609
Total number of Limit Nodes:	14

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\bEsOrli29K.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 0040A1D9
", xrefs: 0040A078
%X%08X, xrefs: 0040A0B0
\, xrefs: 00409D0C
edgikboy, xrefs: 0040A389, 0040A397
P, xrefs: 00409DAA
D, xrefs: 00409F8E
", xrefs: 00409EDB
C:\Users\user\Desktop\bEsOrli29K.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
", xrefs: 0040A189

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\bEsOrli29K.exe$C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe$D$P$\$edgikboy
API String ID: 2089075347-4142227159
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 004250B9 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 271
memorywindowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(?,00000000), ref: 00425148
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00425154
GetActiveWindow.USER32 ref: 0042515A
LoadIconA.USER32(00000000,00000000), ref: 00425162
InflateRect.USER32(00000000,00000000,00000000), ref: 0042516F
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 00425178
GetAtomNameA.KERNEL32(00000000,?,00000000), ref: 00425185
InitAtomTable.KERNEL32(00000000), ref: 0042518C
GetCurrentConsoleFont.KERNEL32(00000000,00000000,?), ref: 00425199
DebugBreak.KERNEL32 ref: 0042519F
EnumDateFormatsW.KERNEL32(00000000,00000000,00000000), ref: 004251A8
SetCommMask.KERNELBASE(00000000,00000000), ref: 004251D9
GetTickCount.KERNEL32 ref: 004251DF
GetDateFormatA.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 00425203
GetSystemTimes.KERNELBASE(?,?,?), ref: 00425218
FoldStringA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0042523E
GetTimeFormatA.KERNEL32(00000000,00000000,0042C4E0,0042C4E0,?,00000000), ref: 0042527F
HeapLock.KERNEL32(00000000), ref: 00425286
FormatMessageW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0042529A
GlobalAlloc.KERNELBASE(00000000), ref: 00425338
LoadLibraryA.KERNELBASE(0042C520), ref: 0042537B
VirtualProtect.KERNELBASE(00000040,?), ref: 00425394
GetProcessIoCounters.KERNEL32(00000000,00000000), ref: 004253AC
UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004253B7

Strings

}$, xrefs: 004253CB
k`, xrefs: 004253BD

Memory Dump Source

Source File: 0000000C.00000002.2281330949.0000000000418000.00000020.00000001.01000000.00000005.sdmp, Offset: 00418000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_418000_pwdgvjcm.jbxd

Similarity

API ID: Format$AtomDateLoad$ActiveAllocBreakCacheCommConsoleCountCountersCurrentDebugEnumExchangeFileFlushFoldFontFormatsGlobalHeapIconInflateInitInstructionInterlockedLibraryLockMaskMessageNameProcessProtectRectStringSystemTableTickTimeTimesUnlockVirtualWindowlstrcat
String ID: k`$}$
API String ID: 1758670013-956986773
Opcode ID: 11a06e5e142067575ebe82f8eff95b9e5a09bdf74230d629ed085f9a8f10a717
Instruction ID: 06bb82473ef69684721e713d6b0dfcdbaab8e4b9c375e17e3125242d7fe09b8c
Opcode Fuzzy Hash: 11a06e5e142067575ebe82f8eff95b9e5a09bdf74230d629ed085f9a8f10a717
Instruction Fuzzy Hash: 6E81E671602A30BBC225AB62FC49DAF7B6CFF4A355B40103AF545D21A1D7389542CBEE

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 005D003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005D024D

Strings

cess, xrefs: 005D018D
kernel32.dll, xrefs: 005D008F, 005D0095

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: fc9b128c1f50d28fefb36c0545add9695854d6336b218cbceaeb3d9a397e2676
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 7D526A74A01229DFDB64CF58C985BA8BBB1BF09314F1480DAE94DAB351DB30AE85DF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406DC2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,xa,,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Strings

xa,, xrefs: 00406DC5, 00406E06, 00406E2E

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID: xa,
API String ID: 1823874839-1065553563
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 006239BE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006239E6
Module32First.KERNEL32(00000000,00000224), ref: 00623A06

Memory Dump Source

Source File: 0000000C.00000002.2281554914.0000000000623000.00000040.00000020.00020000.00000000.sdmp, Offset: 00623000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_623000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: e664b543b6a69eabb91ed830653466acb989a401e717214d0a02ca4e310a6f45
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 11F06831600B346BD7203AB5A88DBAA76EDAF45724F100529F646912C0D7B4ED454E61

Function 005D0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005D0223,?,?), ref: 005D0E19
SetErrorMode.KERNELBASE(00000000,?,?,005D0223,?,?), ref: 005D0E1E

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: c5d6d6fa0513ea3056317b239f3eb2f6e5cae715dba88dd75ef451771bbf1679
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 47D0123114512877D7102A94DC09BCD7F1CDF05B62F008412FB0DD9180C770994046E5

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 0062367D Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006236CE

Memory Dump Source

Source File: 0000000C.00000002.2281554914.0000000000623000.00000040.00000020.00020000.00000000.sdmp, Offset: 00623000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_623000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 01f884fe29f1804d3baa5dd0f66adbba95108582e4eee9bec5b5d3d9b0ce145a
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E2113C79A00218EFDB01DF98C985E98BFF5AF08350F058094F9489B362E375EA90DF84

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 005D65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 005D65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 005D6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 005D6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 005D6652

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 724f06db76546f9bca8909c5dca4465b28895f363dc74277375ac69ae824fa31
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: F6119171600219BFDB219F69EC0AF9B3FA8FB057A5F104026F909A7251D7B1DD40C7A4

Function 005D9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 005D9E6D
lstrcpy.KERNEL32(?,00000000), ref: 005D9FE1
lstrcat.KERNEL32(?,?), ref: 005D9FF2
lstrcat.KERNEL32(?,0041070C), ref: 005DA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 005DA054
DeleteFileA.KERNEL32(?), ref: 005DA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 005DA0D6
lstrcpy.KERNEL32 ref: 005DA12F
lstrlen.KERNEL32(00000022), ref: 005DA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 005D9F13

Part of subcall function 005D7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,xa,,00000000,00000000,00000000,00000000), ref: 005D7081

Part of subcall function 005D6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\utwyareo,005D7043), ref: 005D6F4E
Part of subcall function 005D6F30: GetProcAddress.KERNEL32(00000000), ref: 005D6F55
Part of subcall function 005D6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 005D6F7B
Part of subcall function 005D6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 005D6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 005DA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 005DA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 005DA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 005DA21B
GetDriveTypeA.KERNEL32(?), ref: 005DA265
lstrcat.KERNEL32(?,00000000), ref: 005DA29F
lstrcat.KERNEL32(?,00410A34), ref: 005DA2C5
lstrcat.KERNEL32(?,00000022), ref: 005DA2D9
lstrcat.KERNEL32(?,00410A34), ref: 005DA2F4
wsprintfA.USER32 ref: 005DA31D
lstrcat.KERNEL32(?,00000000), ref: 005DA345
lstrcat.KERNEL32(?,?), ref: 005DA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 005DA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 005DA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 005DA1D1

Part of subcall function 005D9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 005D999D
Part of subcall function 005D9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 005D99BD
Part of subcall function 005D9966: RegCloseKey.ADVAPI32(?), ref: 005D99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 005DA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 005DA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 005DA41D

Strings

", xrefs: 005DA3F0
", xrefs: 005DA142
P, xrefs: 005DA011
\, xrefs: 005D9F73
", xrefs: 005DA2DF
D, xrefs: 005DA1F5

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 790afc0e6fa49e5b8049351824d8046ada3f71bb4c1c9cd8be9b06b06ea534f5
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 8EF130B1D4025AAFDF21DBA4CC49EEF7BBCBB48300F1444A7E605E2241E7758A858F65

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlLengthSid, xrefs: 00401246
ntdll.dll, xrefs: 0040100D
RtlSetLastWin32Error, xrefs: 004010D6
RtlNtStatusToDosError, xrefs: 00401194
NtClose, xrefs: 004011B4
NtDuplicateToken, xrefs: 004011F3
NtFilterToken, xrefs: 0040122B
RtlInitUnicodeString, xrefs: 00401135
NtSetInformationToken, xrefs: 00401175
NtTerminateProcess, xrefs: 004010F6
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlFreeSid, xrefs: 00401116
NtQueryInformationToken, xrefs: 00401262
NtOpenProcessToken, xrefs: 004011D4
NtSetInformationThread, xrefs: 00401155
RtlExpandEnvironmentStrings_U, xrefs: 004010BC

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Jul, xrefs: 0040B280
Thu, xrefs: 0040B241
Tue, xrefs: 0040B233
Aug, xrefs: 0040B287
Nov, xrefs: 0040B29C
Sun, xrefs: 0040B225
Dec, xrefs: 0040B2A3
Mar, xrefs: 0040B264
Jun, xrefs: 0040B279
Sep, xrefs: 0040B28E
May, xrefs: 0040B272
Oct, xrefs: 0040B295
Mon, xrefs: 0040B22C
Apr, xrefs: 0040B26B
Jan, xrefs: 0040B256
Fri, xrefs: 0040B248
Wed, xrefs: 0040B23A
Feb, xrefs: 0040B25D
Sat, xrefs: 0040B24F
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24
D, xrefs: 00407B0C

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe$D
API String ID: 2976863881-1963506762
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 005D7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 005D7D21
GetUserNameA.ADVAPI32(?,?), ref: 005D7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005D7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 005D7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 005D7DC0
EqualSid.ADVAPI32(?,?), ref: 005D7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 005D7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005D7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 005D7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 005D7E12
LocalFree.KERNEL32(00000000), ref: 005D7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005D7E35

Strings

D, xrefs: 005D7D73
C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 005D7F49, 005D7F76, 005D7F8A, 005D7F8B

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe$D
API String ID: 2976863881-1963506762
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 0a0f89206935e58106474aff8587a6e83d350837e38f3ceff30143f30c251fd0
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 8CA13F7190021DAFDB218FA4DD88BEEBF7DFB48340F14806BE505E6250E7758A85CB64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
except_info, xrefs: 00406728
plgs:, xrefs: 004066AA
Jan 13 2018, xrefs: 0040653A
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
va=%08X%08X uef=%p, xrefs: 00406595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
12:08:32, xrefs: 00406535
%d=%p, xrefs: 004066F9
localcfg, xrefs: 0040672D

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

AUTH LOGIN, xrefs: 0040A80C
Incorrect respons, xrefs: 0040AB39
rcpt to:<%s>, xrefs: 0040A855
data, xrefs: 0040A85E
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
ESMTP, xrefs: 0040AA38
., xrefs: 0040A8CA
Too small respons, xrefs: 0040A9C9
localcfg, xrefs: 0040AB0B
ehlo %s, xrefs: 0040A7F5
helo %s, xrefs: 0040A803
quit, xrefs: 0040A86C
Too big smtp respons (%d bytes), xrefs: 0040A9B1
mail from:<%s>, xrefs: 0040A848

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 005D7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005D7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005D7ACD
GetLengthSid.ADVAPI32(?), ref: 005D7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 005D7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 005D7B1F
EqualSid.ADVAPI32(?,?), ref: 005D7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 005D7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005D7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 005D7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 005D7B77
LocalFree.KERNEL32(00000000), ref: 005D7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005D7B9A
GetAce.ADVAPI32(?,?,?), ref: 005D7BCA
EqualSid.ADVAPI32(?,?), ref: 005D7BF1
DeleteAce.ADVAPI32(?,?), ref: 005D7C0A
EqualSid.ADVAPI32(?,?), ref: 005D7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 005D7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005D7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 005D7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 005D7CE0
LocalFree.KERNEL32(00000000), ref: 005D7CEE

Strings

D, xrefs: 005D7AC3

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: b73b75a8f9cee4a95fb75306b40a337752de714441a5ff4e3c4379bcdec78e07
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: E1812A7190421DAFDB218FA8DD48BEEBFB8BB0C304F04806BE515E6250E7759A45CB64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 004085C8, 004085D5, 004085E5
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe$localcfg
API String ID: 237177642-3670105814
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

PDGu, xrefs: 0040139A
@, xrefs: 00401380
useless, xrefs: 0040161E
uac, xrefs: 00401628
%systemroot%\system32\cmd.exe, xrefs: 00401316
, xrefs: 00401462
<, xrefs: 00401378
wusa.exe, xrefs: 00401388
D, xrefs: 004015C6

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

born_date, xrefs: 00401EAD, 00401ECC
loader_id, xrefs: 00401F4B, 00401F6B
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
net_type, xrefs: 00401E87
start_srv, xrefs: 00401E6C
work_srv, xrefs: 00401E5E
IsWow64Process, xrefs: 00401DF2
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
lid_file_upd, xrefs: 00401E25
kernel32, xrefs: 00401DF7
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

Iphlpapi.dll, xrefs: 004019B7
123.45.67.89, xrefs: 004019A6
GetIfEntry, xrefs: 004019E4
GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 005D858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 005D865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 005D867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 005D86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 005D86B1

Strings

", xrefs: 005D896C
C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 005D882F, 005D883C, 005D884C

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe
API String ID: 237177642-4283548912
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 49859bb115af94fcd2b2799caf0e8e1723cd782c2f5213d18b969d2233e6b25e
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 2EC1B171900109BEEB31ABA8DC89EFF7FBCFB54300F144067F605E6251EA718A949B65

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 005D14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 005D1601
lstrlenW.KERNEL32(-00000003), ref: 005D17D8

Strings

, xrefs: 005D16C9
<, xrefs: 005D15DF
@, xrefs: 005D15E7
D, xrefs: 005D182D

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 1f587ea8c9f1cbea464a086a24dec4981ceb02a69caea8780c262e8bd5aeea8f
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 9EF18FB1508741AFD720CF68C898BABBBE5FB88301F10892EF595973A0D7749944CB5A

Function 005D7666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 005D76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 005D7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 005D778F
___ascii_stricmp.LIBCMT ref: 005D78B4
RegCloseKey.ADVAPI32(?), ref: 005D794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 005D796D
RegCloseKey.ADVAPI32(?), ref: 005D797E
RegCloseKey.ADVAPI32(?), ref: 005D79AC
RegCloseKey.ADVAPI32(?), ref: 005D7A56

Part of subcall function 005DF40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,005D772A,?), ref: 005DF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 005D79F6
RegCloseKey.ADVAPI32(?), ref: 005D7A4D

Strings

", xrefs: 005D7800

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 09e32d7d0ac96380636e1dcf572ebb4d3c4b846ea5951cd4d857d757c7b959bd
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 61C1637290410AABDB319BA8DC49FEE7FB9FF49310F1440A7F505E6251EB719A84CB60

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 005D2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 005D2CED
socket.WS2_32(00000002,00000002,00000011), ref: 005D2D07
htons.WS2_32(00000000), ref: 005D2D42
select.WS2_32 ref: 005D2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 005D2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 005D2E62

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: c0d1e1bf965b5e4e9165bd2a8f232fe101f3bce11028e885538dccef172360ad
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 3761C071504306ABC330AF68DC09B6BBFE8FBA8341F14481BF98597351D7B598819BA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s%d, xrefs: 0040AE58
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s@%s, xrefs: 0040B461
%DATE, xrefs: 0040B4D2
%FROM_EMAIL, xrefs: 0040B3E9
%M5DATE, xrefs: 0040B50F
%FROM_DOMAIN, xrefs: 0040B41E
%FROM_USER, xrefs: 0040B431
%P5DATE, xrefs: 0040B4F2
%TO_HASH, xrefs: 0040B4B0
%TO_USER, xrefs: 0040B488
%TO_EMAIL, xrefs: 0040B473
%TO_DOMAIN, xrefs: 0040B44B

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 005D1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 005D202D
GetSystemInfo.KERNEL32(?), ref: 005D204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 005D206A
GetProcAddress.KERNEL32(00000000), ref: 005D2071
GetCurrentProcess.KERNEL32(?), ref: 005D2082
GetTickCount.KERNEL32 ref: 005D2230

Part of subcall function 005D1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 005D1E7C

Strings

work_srv, xrefs: 005D20C5
flags_upd, xrefs: 005D20A5, 005D20AA, 005D20E3
localcfg, xrefs: 005D2091, 005D2098, 005D20AB, 005D20E4, 005D20F3, 005D2119, 005D2138, 005D214E, 005D2166, 005D2183, 005D219B, 005D21B7, 005D21D7
hi_id, xrefs: 005D217D, 005D2182, 005D219A

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 12629b9a0b39aed31878ea22c3882ea0726a22e6013ef7cd0d5cb396972604e1
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: A551C4B0500745AFE330AF698C8AF67BEECFF94704F00491FF99686242D6B5A944C765

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 005D3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 005D3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 005D3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 005D3095
RtlAllocateHeap.NTDLL(00000000), ref: 005D30B6
htons.WS2_32(00000035), ref: 005D30EF
inet_addr.WS2_32(?), ref: 005D30FA
gethostbyname.WS2_32(?), ref: 005D310D
HeapFree.KERNEL32(00000000), ref: 005D314D

Strings

iphlpapi.dll, xrefs: 005D3062, 005D3067, 005D3077

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 13b66ea3028828ed5eb07d4188f46e69ea1cd91e3421b318907603c670b0c912
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 3F317331A00607ABDB219BFC9C48AAE7FB8BF04760F144167E518E7390DB74DA81CB59

Function 005D958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 005D95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005D95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 005D95DC
wsprintfA.USER32 ref: 005D9635
wsprintfA.USER32 ref: 005D9673
wsprintfA.USER32 ref: 005D96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 005D9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 005D978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 005D97D8

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 145fcbf2f72bb3197a6aacea06b5466b13db8b1a6ec8106c2a55e10a7fc367b5
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 03A17BB1900209EBEB31DFA8DC49FDA3BACFB45741F104027FA0592252E7B5D984DBA5

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 005D6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 005D67C3
htonl.WS2_32(?), ref: 005D67DF
htonl.WS2_32(?), ref: 005D67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 005D68F1
ExitProcess.KERNEL32 ref: 005D69BC

Strings

localcfg, xrefs: 005D6994
except_info, xrefs: 005D698F

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 295462ccc4268915ade6b3c39272996d0f0279c3afa61970c2733f812bc8d769
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 84616F71940208AFDB609FB4DC45FEA7BE9FB48300F148066F96DD2261DA7599908F54

Function 005DF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(005DCC84), ref: 005DF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 005DF5CE
closesocket.WS2_32(00000000), ref: 005DF5DC

Strings

time_cfg, xrefs: 005DF58A

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: da277ce23ba1222ad4196c45ea0effbc84f01b73f05317e0c70c9b40256d735e
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 37314D71900119ABDB20DFA9EC899EE7BBCFF89310F104567F916D3250E7709A818BA5

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 005D2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 005D2FA1
LoadLibraryA.KERNEL32(?), ref: 005D2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 005D2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 005D3000
RtlAllocateHeap.NTDLL(00000000), ref: 005D3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 005D3032

Strings

dnsapi.dll, xrefs: 005D2F90

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 7f98211b1bf62594838183bfa313379f746b948d64238f18bd40ae43c54d94d4
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 0621607190162ABBCB319B59DC49AAEBFB8FF18B50F104423F905E7240D7B49E8187E4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 005D99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 005D9A18
GetThreadContext.KERNEL32(?,?), ref: 005D9A52
TerminateProcess.KERNEL32(?,00000000), ref: 005D9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 005D9A98
SetThreadContext.KERNEL32(?,00010002), ref: 005D9AB5
ResumeThread.KERNEL32(?), ref: 005D9AC2

Strings

D, xrefs: 005D9A10

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 15e8748a3d9238e8cb73c1661cd2990465b1a0e6b1bd375ba30fe2a2cc18282e
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: D2213D72901119BBDB219BA5DC09EEFBFBCFF04750F404062BA19E5150E7758A84CBA4

Function 005D1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 005D1C18
LoadLibraryA.KERNEL32(004102C8), ref: 005D1C26
GetProcessHeap.KERNEL32 ref: 005D1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 005D1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 005D1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 005D1D02
FreeLibrary.KERNEL32(?), ref: 005D1D0B

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 1a3d4c5b01d3d4b07eca3babc8f7cb355f6881fe6fff4e51dc0ab96d13d0abc1
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 6A311271D00619BFCB219FA8DC888AEBFB5FB45751B24447BE501A6210D7B54D80DB58

Function 005D6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 005D6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 005D6D22
GetLastError.KERNEL32 ref: 005D6DA7
CloseHandle.KERNEL32(?), ref: 005D6DB5
GetLastError.KERNEL32 ref: 005D6DD6
DeleteFileA.KERNEL32(?), ref: 005D6DE7
GetLastError.KERNEL32 ref: 005D6DFD

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: e940d2a75dc8df214f1952524e739723f20180dfcfd671173984c90933cfec93
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: C631F376A00149BFCB21EFA8AD49ADE7F7AFB48300F148067E251E7351D7708986CB61

Function 005D6F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\utwyareo,005D7043), ref: 005D6F4E
GetProcAddress.KERNEL32(00000000), ref: 005D6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 005D6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 005D6F92

Strings

\\.\pipe\utwyareo, xrefs: 005D6F37
C:\Windows\SysWOW64\, xrefs: 005D6F30, 005D6F38, 005D6F65, 005D6F6C, 005D6F7A, 005D6F85, 005D6F91, 005D6FA9, 005D6FC6, 005D6FEC

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\utwyareo
API String ID: 1082366364-2792396914
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 08f246d0a85f00304f40e4e9589a4c5ad059f787a6f5d8b727220001d5d2ad6a
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: D12126217443457AF7325339AC8DFFB2E4CAB66710F1880A7F404D62C1EAD988D6826D

Function 00424F61 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 00424F8B
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00424FC7
GetComputerNameA.KERNEL32(?,?), ref: 00424FDB
SetCalendarInfoW.KERNEL32(00000000,00000000,00000000,0042C41C), ref: 00424FE9
OpenJobObjectA.KERNEL32(00000000,00000000,0042C428), ref: 00424FF6

Strings

-, xrefs: 00425003

Memory Dump Source

Source File: 0000000C.00000002.2281330949.0000000000418000.00000020.00000001.01000000.00000005.sdmp, Offset: 00418000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_418000_pwdgvjcm.jbxd

Similarity

API ID: NodeNuma$CalendarComputerHighestInfoNameNumberObjectOpenProcessor
String ID: -
API String ID: 3293808458-2547889144
Opcode ID: cbd7c5c07cb5078078958f77ac79951bebb201362ab674e3885adec3f36132ee
Instruction ID: 0eccb1aac1e8823434b1d3e5e9d8e26066e9430f249d9380e5c281313551a7e7
Opcode Fuzzy Hash: cbd7c5c07cb5078078958f77ac79951bebb201362ab674e3885adec3f36132ee
Instruction Fuzzy Hash: 1C11D271600228EFCB21AF21ED8499F7BB8FB84318F408179E629A6141C7385A86CF5C

Function 005DAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 005DAAE5

Strings

localcfg, xrefs: 005DAD72
, xrefs: 005DABB3

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: a78bf875bbf6f48c1acdfdf1d6f051be1f1f7f37a021c34f95d1d7062c5ae462
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 95711871A00305AAEF319B5CDC85BEF3F6ABB40315F244427F905A62E1DB618DC4875B

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 005DE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005DDF6C: GetCurrentThreadId.KERNEL32 ref: 005DDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 005DE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,005D6128), ref: 005DE950
lstrcmp.KERNEL32(?,00000008), ref: 005DE989

Strings

A, xrefs: 005DE8C6, 005DE8CD, 005DE936, 005DE998
A, xrefs: 005DE960, 005DE965
A, xrefs: 005DE9A0

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 4c328d0610a80c2960574834c60f5b8af0e76569538d5d1fbd5bf0187ab3abcf
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: EE318F31601706DBDB71AF28C89ABA67FE4FB05721F10892BE5558B751D370E881CB91

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 005D6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 005D6E19

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: ecdcc4afc8e05ff0c8d6f00896c901b4c770158dd5a7ee9ed7de7cda028deeb7
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 1B214D76104115FFDB20ABA8EC49EDF3FADEB49361B208427F502D5291EB709A4196B4

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 005D92CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 005D92E2
wsprintfA.USER32 ref: 005D9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 005D9375
lstrlen.KERNEL32(?,?,00000000), ref: 005D9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 005D9394
CloseHandle.KERNEL32(00000000), ref: 005D939B

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: ef4917c6cbf98d75ce25ed568e8581b1dfa7febf4c17f263ca8e9b33fc5370a4
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 281172B16401157BE7317735EC0EFEF3E6EEBC8B10F008067BB09A5191EAB44A918664

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 005DC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 005DC6B4
InterlockedIncrement.KERNEL32(005DC74B), ref: 005DC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,005DC747), ref: 005DC728
CloseHandle.KERNEL32(00000000,?,005DC747,00413588,005D8A77), ref: 005DC733

Strings

localcfg, xrefs: 005DC544

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: ef5c8d2c690d3bc639a3424b6281501a24b8c16aa4649ca8598b61e41de10acf
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 115105B1A01B428FD7749F6DD68562ABEE9FB88300B50593FE18BC7B90D674E844CB50

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe
API String ID: 124786226-2804431639
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 005DE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,005DE50A,00000000,00000000,00000000,00020106,00000000,005DE50A,00000000,000000E4), ref: 005DE319
RegSetValueExA.ADVAPI32(005DE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 005DE38E
RegDeleteValueA.ADVAPI32(005DE50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D]), ref: 005DE3BF
RegCloseKey.ADVAPI32(005DE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D],005DE50A), ref: 005DE3C8

Strings

D], xrefs: 005DE2FC

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: D]
API String ID: 2667537340-1711158228
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 0533f3a7296e50370b9fedde217470e36ca5c30c9c8367686a16d37b510a5297
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 46215271A0021DBBDF209FA9EC8AEEE7F79EF09750F008422F905D7251E2719A54D790

Function 005D71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005D71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005D7228
LocalFree.KERNEL32(?,?,?), ref: 005D7286
wsprintfA.USER32 ref: 005D729D

Strings

|, xrefs: 005D721A

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 93dfb6f77ab81f858740611d9f939a844f30dc6b31eb7c22d25469abd89e6e2a
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 1E312976904209BBCB11DFA8DC49ADA7FACFF08314F148167F859DB201EB75DA488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 005DB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005DB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005DB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 005DB548
GetTimeZoneInformation.KERNEL32(?), ref: 005DB590
wsprintfA.USER32 ref: 005DB61E

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 81b44bffddd77b389158e06481a58dfb2b0799f740e1d12bada9c0614a3dcc9f
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D5512171D0021DEADF24DFD5D8495EEBBB9BF48304F10815BE501A6250E7B84AC9CF94

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 005D62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 005D6303
LoadLibraryA.KERNEL32(?), ref: 005D632A
GetProcAddress.KERNEL32(00000000,?), ref: 005D63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 005D6405

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: cd87d22501b673e2ccd1111604e32b0fe0a116d817727f1f9c0e8c22c3ea68f9
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: DF413A71A0020AEBDB24CF5CC884AA9BBB8FF14354F24896BE815D7390E775ED42DB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 005D93AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005D93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 005D93CD
CharToOemA.USER32(?,?), ref: 005D93DB
wsprintfA.USER32 ref: 005D9410

Part of subcall function 005D92CB: GetTempPathA.KERNEL32(00000400,?), ref: 005D92E2
Part of subcall function 005D92CB: wsprintfA.USER32 ref: 005D9350
Part of subcall function 005D92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 005D9375
Part of subcall function 005D92CB: lstrlen.KERNEL32(?,?,00000000), ref: 005D9389
Part of subcall function 005D92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 005D9394
Part of subcall function 005D92CB: CloseHandle.KERNEL32(00000000), ref: 005D939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 005D9448

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 37431542392af53c1b046721dc73c329a1c317a73f60199580d465bee98a69c9
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 7A0192F69001187BDB30A7619D4DEDF3B7CEB95701F0000A2BB09E2080EAB496C58F75

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 005D28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 005D28FA
gethostbyname.WS2_32(u6A), ref: 005D2906

Strings

u6A, xrefs: 005D28EC, 005D28F9, 005D2905
time_cfg, xrefs: 005D28EB

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 70faf734500188528e8d2273c3796b91b82e51b9fa39a070ed032831f4cf0cf6
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: C6E082306082218FCB208B2CF848ACA3BA4AF2A330F008182F080C32A1C7349CC0AB80

Function 005D69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 005D69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 005D6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 005D6A3A
CloseHandle.KERNEL32(000000FF), ref: 005D6BD8

Part of subcall function 005DEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,005D1DCF,?), ref: 005DEEA8
Part of subcall function 005DEE95: HeapFree.KERNEL32(00000000), ref: 005DEEAF

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 1bfbcd70b105b14779d9c81b2eab0bdef2c08d6f103b13e5ae6fa7ee2c337295
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 95710671900219EFDB20DFA8CC849EEBFB9FB08314F10456BE515E6290D7749E92DB50

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 00425028 Relevance: 6.0, APIs: 4, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetFullPathNameA.KERNEL32(00000000,00000000,?,00000000), ref: 0042505E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042507A
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00425098
SetFileShortNameA.KERNEL32(00000000,0042C460), ref: 004250A4

Memory Dump Source

Source File: 0000000C.00000002.2281330949.0000000000418000.00000020.00000001.01000000.00000005.sdmp, Offset: 00418000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_418000_pwdgvjcm.jbxd

Similarity

API ID: Name$CreateEnvironmentFileFreeFullHeapPathShortStrings
String ID:
API String ID: 4071102102-0
Opcode ID: bc69b1226fcf67db89fe464c706799af24d95d8a8024064d16ebc773a46ea2e6
Instruction ID: 5c8f484b8e6f5073547a08100acdc7810c7886e53351bf40ac3baed53192359c
Opcode Fuzzy Hash: bc69b1226fcf67db89fe464c706799af24d95d8a8024064d16ebc773a46ea2e6
Instruction Fuzzy Hash: 6E015E76701514ABC721AB66FD88D6F77BCE7C9709780102AF601D2190DA385942CAAD

Function 00425F00 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00425F26

Part of subcall function 00425D4B: __fltout2.LIBCMT ref: 00425D77

__cftog_l.LIBCMT ref: 00425F4C
__cftoe_l.LIBCMT ref: 00425F7E

Memory Dump Source

Source File: 0000000C.00000002.2281330949.0000000000418000.00000020.00000001.01000000.00000005.sdmp, Offset: 00418000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_418000_pwdgvjcm.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 62ab4b8ba8e517d9559e8c491edd40464884d24b5327c3800230cc66b45608ab
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: BE11923211455EBBCF125F84ED05CEE3F22BB18354F998416FE1859130D33ACAB2AB89

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 005D417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 005D41AB
GetLastError.KERNEL32 ref: 005D41B5
WaitForSingleObject.KERNEL32(?,?), ref: 005D41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 005D41D9

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 938ea05c2b33ebe07b19f718510d6ea4b465b2fd2e03758917cc72b0f1c6447b
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: D501E57691110AABDF11DF94ED84BEE7BACFB18355F108062F901E2150D7709AA4CFB6

Function 005D41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 005D421F
GetLastError.KERNEL32 ref: 005D4229
WaitForSingleObject.KERNEL32(?,?), ref: 005D423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 005D424D

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: b5ace9c324a562269a34ee6a3f8d4f65acccef4e513d0ea2852e7db145b6e14a
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 4C01E272911209ABDF11DF94EE85BEE7BACFB08356F108462F901E2150D770AA548FB6

Function 005DE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 005DE066

Strings

A, xrefs: 005DE037, 005DE03C
A, xrefs: 005DE07F
A, xrefs: 005DE036

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: f88f3c38dde413f6c3b730ffbc7260450f7f2244f7696d2f07ed0d68900fb4db
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: E7F06831200701DBCB30EF19D888982BBE9FB05321B44862BE158C7160D3B4A899CB51

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 005DE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,D],00000000,00000000,00000000), ref: 005DE470
CloseHandle.KERNEL32(00000001,00000003), ref: 005DE484

Part of subcall function 005DE2FC: RegCreateKeyExA.ADVAPI32(80000001,005DE50A,00000000,00000000,00000000,00020106,00000000,005DE50A,00000000,000000E4), ref: 005DE319
Part of subcall function 005DE2FC: RegSetValueExA.ADVAPI32(005DE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 005DE38E
Part of subcall function 005DE2FC: RegDeleteValueA.ADVAPI32(005DE50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D]), ref: 005DE3BF
Part of subcall function 005DE2FC: RegCloseKey.ADVAPI32(005DE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D],005DE50A), ref: 005DE3C8

Strings

D], xrefs: 005DE498, 005DE4BD, 005DE41A, 005DE447, 005DE4C0, 005DE41D, 005DE459, 005DE45A, 005DE46C, 005DE49B

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: D]
API String ID: 4151426672-1711158228
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: dc5496224fa060664e5f9d6dc4f23cf0dcee1aa31aef93f0ffce418c5a7d3b2a
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 4841E771900205BAEB30BA598C4BFEF3F6CFB54764F048027F90998292E2B58A50D6B5

Function 005D8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 005D83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 005D8477

Part of subcall function 005D69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 005D69E5
Part of subcall function 005D69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 005D6A26
Part of subcall function 005D69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 005D6A3A

Part of subcall function 005DEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,005D1DCF,?), ref: 005DEEA8
Part of subcall function 005DEE95: HeapFree.KERNEL32(00000000), ref: 005DEEAF

Strings

C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 005D848C, 005D84A1

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe
API String ID: 359188348-2804431639
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 8179ea95022e2f9fde0385f33fb398217087cd3b7af4c29a4966163595f7c7cd
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: C24140B290010ABEDF30EBA89E85DFF7F6CFB44344F1444A7E505D6211EAB05A588B55

Function 005DAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005DAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 005DB00D

Part of subcall function 005DAF6F: gethostname.WS2_32(?,00000080), ref: 005DAF83
Part of subcall function 005DAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 005DAFE6

Part of subcall function 005D331C: gethostname.WS2_32(?,00000080), ref: 005D333F
Part of subcall function 005D331C: gethostbyname.WS2_32(?), ref: 005D3349

Part of subcall function 005DAA0A: inet_ntoa.WS2_32(00000000), ref: 005DAA10

Strings

%OUTLOOK_BND_, xrefs: 005DB076, 005DB07B, 005DB0BE, 005DB0DD

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 1a07532295d09df3ccb16a71453da254db496f2d83bce4828bcdaf45b5263558
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 6441507290020DABDB25EFA4DC4AEEF3BADFF48300F144427F92592252EA75D694CB54

Function 005D9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 005D9536
Sleep.KERNEL32(000001F4), ref: 005D955D

Strings

, xrefs: 005D94D9

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: d0bcdb184b75eb0bb3398d3c43d0dab347ce8eb8529f2bc606201c95fa7578d0
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 8741F3B19083856EEF379B6CE88D7A67FA4BF02314F2841B7D486973A3D6B44D818711

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 005DBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 005DB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 005DBA3A
InterlockedIncrement.KERNEL32(?), ref: 005DBA94
GetTickCount.KERNEL32 ref: 005DBB79
GetTickCount.KERNEL32 ref: 005DBB99
InterlockedIncrement.KERNEL32(?), ref: 005DBE15
closesocket.WS2_32(00000000), ref: 005DBEB4

Strings

%FROM_EMAIL, xrefs: 005DBC7D

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 83a3d023157e6739ef1b1234f663778593bd58c7d8e52f674008127dff3540b8
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 23316D71400248DFEF35DFA8DC48AE97BB9FB48700F204557FA2482251DB30DA85CB14

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 005D709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 005D70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 005D70F4

Strings

|, xrefs: 005D70E6

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 3f7ee894e840d76203ecb8ec0937873798e74ea021d5f28c057c364682c219a7
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 7511007290411CEBDF21CFD8DC85ADEBBBDBB08715F1442A7E501E6150E6709B44DBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000C.00000002.2281311296.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 005D3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005D2F88: GetModuleHandleA.KERNEL32(?), ref: 005D2FA1
Part of subcall function 005D2F88: LoadLibraryA.KERNEL32(?), ref: 005D2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 005D31DA
HeapFree.KERNEL32(00000000), ref: 005D31E1

Memory Dump Source

Source File: 0000000C.00000002.2281478494.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5d0000_pwdgvjcm.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: d344f1e241af3476aa63c6902cade786c5bbc1f6f4a257e2c1cdc5436b4201e0
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 2251AA7590024AAFCB219F68D8889EABB75FF19300F14456AEC96C7311E7329A19CB91

Analysis Process: svchost.exePID: 3552, Parent PID: 5496COMMON

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1807
Total number of Limit Nodes:	18

Executed Functions

Function 004CC913 Relevance: 115.1, APIs: 45, Strings: 20, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 004CCA4E
closesocket.WS2_32(?), ref: 004CCB63
GetTempPathA.KERNEL32(00000120,?), ref: 004CCC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 004CCCB4
WriteFile.KERNEL32(004CA4B3,?,-000000E8,?,00000000), ref: 004CCCDC
CloseHandle.KERNEL32(004CA4B3), ref: 004CCCED
wsprintfA.USER32 ref: 004CCD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 004CCD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 004CCD89
CloseHandle.KERNEL32(?), ref: 004CCD98
CloseHandle.KERNEL32(?), ref: 004CCD9D
DeleteFileA.KERNEL32(?), ref: 004CCDC4
CloseHandle.KERNEL32(004CA4B3), ref: 004CCDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 004CCFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 004CCFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 004CD033
lstrcatA.KERNEL32(?,03B00108), ref: 004CD10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 004CD155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 004CD171
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000), ref: 004CD195
CloseHandle.KERNEL32(00000000), ref: 004CD19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 004CD1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 004CD231
lstrcatA.KERNEL32(?,03B00108,?,?,?,?,?,?,?,00000100), ref: 004CD27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 004CD2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 004CD2C7
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 004CD2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 004CD2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 004CD326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 004CD372
lstrcatA.KERNEL32(?,03B00108,?,?,?,?,?,?,?,00000100), ref: 004CD3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 004CD3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 004CD408
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 004CD428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 004CD42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 004CD45B
CreateProcessA.KERNEL32(?,004D0264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 004CD4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 004CD4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 004CD4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 004CD513
closesocket.WS2_32(?), ref: 004CD56C
Sleep.KERNEL32(000003E8), ref: 004CD577
ExitProcess.KERNEL32 ref: 004CD583
wsprintfA.USER32 ref: 004CD81F

Part of subcall function 004CC65C: send.WS2_32(00000000,?,00000000), ref: 004CC74B

closesocket.WS2_32(?), ref: 004CDAD5

Strings

except_info, xrefs: 004CD8CD, 004CD8D2, 004CD8FB
.dat, xrefs: 004CD0D7, 004CD138, 004CD1AE, 004CD1D4, 004CD28E, 004CD308, 004CD3CF, 004CD441
drivers\, xrefs: 004CD067
@, xrefs: 004CD754
flags_upd, xrefs: 004CCE4A
time_cfg, xrefs: 004CC95B, 004CC962, 004CC971, 004CC984
\, xrefs: 004CD39D
wtm_c, xrefs: 004CC956
local_time, xrefs: 004CCACD
wtm_r, xrefs: 004CC97F
\, xrefs: 004CD3A7
localcfg, xrefs: 004CCA89, 004CCA93, 004CCAC0, 004CCAD2, 004CCE4F, 004CCE6F, 004CD8D3, 004CD8FC
lid_file_upd, xrefs: 004CCE6A
srv_time, xrefs: 004CCABB
.sys, xrefs: 004CD0CC
C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 004CCC10, 004CCCF3, 004CD975, 004CD98E
work_srv, xrefs: 004CD607, 004CD60F, 004CD62C
4, xrefs: 004CD9F7
X M, xrefs: 004CC927, 004CC93C, 004CC9BE
wtm_w, xrefs: 004CC96C

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe$X M$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-4027863486
Opcode ID: 8690d6a7c5bae3174519e945a35180a5e7d5f855766719948976ff36180a9717
Instruction ID: a100a9ca9a9ff00bf69c011ea4bb09a6a761a45104768520831e6c248fe7f7f7
Opcode Fuzzy Hash: 8690d6a7c5bae3174519e945a35180a5e7d5f855766719948976ff36180a9717
Instruction Fuzzy Hash: 1DB2C175D01208BBEB609FA5DD85FEE7BA8AB04304F14007FF609A3291D7789A45CB69

Function 004C9A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 004C9A7F
SetErrorMode.KERNELBASE(00000003), ref: 004C9A83
SetUnhandledExceptionFilter.KERNEL32(004C6511), ref: 004C9A8A

Part of subcall function 004CEC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 004CEC5E
Part of subcall function 004CEC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 004CEC72
Part of subcall function 004CEC54: GetTickCount.KERNEL32 ref: 004CEC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 004C9AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 004C9ABA
GetCommandLineA.KERNEL32 ref: 004C9AFD
lstrlenA.KERNEL32(?), ref: 004C9B99
ExitProcess.KERNEL32 ref: 004C9C06
GetTempPathA.KERNEL32(000001F4,?), ref: 004C9CAC
lstrcpyA.KERNEL32(?,00000000), ref: 004C9D7A
lstrcatA.KERNEL32(?,?), ref: 004C9D8B
lstrcatA.KERNEL32(?,004D070C), ref: 004C9D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 004C9DED
DeleteFileA.KERNEL32(00000022), ref: 004C9E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 004C9E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 004C9EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 004C9ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 004C9F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 004C9F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 004C9F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 004C9FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 004C9FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 004C9FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 004CA038
lstrcatA.KERNEL32(00000022,004D0A34), ref: 004CA05E
lstrcatA.KERNEL32(00000022,00000022), ref: 004CA072
lstrcatA.KERNEL32(00000022,004D0A34), ref: 004CA08D
wsprintfA.USER32 ref: 004CA0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 004CA0DE
lstrcatA.KERNEL32(00000022,?), ref: 004CA0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 004CA120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 004CA131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 004CA174
GetModuleFileNameA.KERNEL32(00000000), ref: 004CA17B
GetDriveTypeA.KERNEL32(00000022), ref: 004CA1B6
GetCommandLineA.KERNEL32 ref: 004CA1E5

Part of subcall function 004C99D2: lstrcpyA.KERNEL32(?,?,00000100,004D22F8,00000000,?,004C9E9D,?,00000022,?,?,?,?,?,?,?), ref: 004C99DF
Part of subcall function 004C99D2: lstrcatA.KERNEL32(00000022,00000000,?,?,004C9E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 004C9A3C
Part of subcall function 004C99D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,004C9E9D,?,00000022,?,?,?), ref: 004C9A52

lstrlenA.KERNEL32(?), ref: 004CA288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 004CA3B7
GetLastError.KERNEL32 ref: 004CA3ED
Sleep.KERNEL32(000003E8), ref: 004CA400
DeleteFileA.KERNELBASE(004D33D8), ref: 004CA407
CreateThread.KERNELBASE(00000000,00000000,004C405E,00000000,00000000,00000000), ref: 004CA42C
WSAStartup.WS2_32(00001010,?), ref: 004CA43A
CreateThread.KERNELBASE(00000000,00000000,004C877E,00000000,00000000,00000000), ref: 004CA469
Sleep.KERNELBASE(00000BB8), ref: 004CA48A
GetTickCount.KERNEL32 ref: 004CA49F
GetTickCount.KERNEL32 ref: 004CA4B7
Sleep.KERNELBASE(00001A90), ref: 004CA4C3

Strings

", xrefs: 004CA189
P, xrefs: 004C9DAA
D, xrefs: 004C9F8E
%X%08X, xrefs: 004CA0B0
", xrefs: 004CA078
\, xrefs: 004C9D0C
C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 004CA1D9
edgikboy, xrefs: 004CA389, 004CA397
", xrefs: 004C9EDB

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe$D$P$\$edgikboy
API String ID: 2089075347-2434236762
Opcode ID: f61c933db9cbb11270716025d22f32e7dafd38ccd34503a40a71075f6b8eb3e9
Instruction ID: 5cb8095f3c29c19dd340804f90d456802daffa6a3e0b71d3e417a04415e4ed8b
Opcode Fuzzy Hash: f61c933db9cbb11270716025d22f32e7dafd38ccd34503a40a71075f6b8eb3e9
Instruction Fuzzy Hash: 03529FB5C01259BBDB519FA19C49FEF7BBCAB04304F1440AFF509A3241EB789E448B69

Function 004C199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004C19B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,004C1E9E), ref: 004C19BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004C19E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004C19ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004C19F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,004C1E9E), ref: 004C1A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,004C1E9E), ref: 004C1A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,004C1E9E), ref: 004C1A36
GetAdaptersInfo.IPHLPAPI(00000000,004C1E9E,?,?,?,?,00000001,004C1E9E), ref: 004C1A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,004C1E9E,?,?,?,?,00000001,004C1E9E), ref: 004C1A5A
GetAdaptersInfo.IPHLPAPI(00000000,004C1E9E,?,?,?,?,00000001,004C1E9E), ref: 004C1A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,004C1E9E), ref: 004C1A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,004C1E9E), ref: 004C1AA4

Strings

GetBestInterface, xrefs: 004C19EF
GetAdaptersInfo, xrefs: 004C19DC
localcfg, xrefs: 004C19A3
GetIfEntry, xrefs: 004C19E4
123.45.67.89, xrefs: 004C19A6
Iphlpapi.dll, xrefs: 004C19B7

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: f2676e7521df5c5164a363c07c4cf256322c3355d4d1e8b289d666a187859663
Instruction ID: 9c25663d24772396025d7156c49d57cf1f69a125ffc89df425ec10cbdb0d1ff2
Opcode Fuzzy Hash: f2676e7521df5c5164a363c07c4cf256322c3355d4d1e8b289d666a187859663
Instruction Fuzzy Hash: C3313035902219AFCB519FE4DC88EAFBBB5EB46301F24457FE501A3221D7364E41DB98

Function 004C7A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 004C7ABA
GetUserNameA.ADVAPI32(?,?), ref: 004C7ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,004D070C,?,?,?), ref: 004C7B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 004C7B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 004C7B59
EqualSid.ADVAPI32(?,00000022), ref: 004C7B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 004C7B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004C7B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 004C7B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 004C7BAB
LocalFree.KERNEL32(00000000), ref: 004C7BB2
GetSecurityDescriptorDacl.ADVAPI32(?,004C7FC9,?,00000000), ref: 004C7BCE

Strings

D, xrefs: 004C7B0C
C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 004C7CE2, 004C7D0F, 004C7D23, 004C7D24

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe$D
API String ID: 2976863881-1963506762
Opcode ID: 1977a15707287f7ca079574bd377fd091b076032e34fd2d7ce7c9678fd5fffa0
Instruction ID: 6ec50d4adfa6d1099f38c785a0dfd911d6a6cf70c51842579be261a68c969a5d
Opcode Fuzzy Hash: 1977a15707287f7ca079574bd377fd091b076032e34fd2d7ce7c9678fd5fffa0
Instruction Fuzzy Hash: 96A13775905219ABDF528FA1DC88FEFBBB8FB44304F14406BE506E2250E7399A45CF68

Function 004C7809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 004C782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 004C7866
GetLengthSid.ADVAPI32(?), ref: 004C7878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 004C789A
GetSecurityDescriptorOwner.ADVAPI32(?,004C7F63,?), ref: 004C78B8
EqualSid.ADVAPI32(?,004C7F63), ref: 004C78D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004C78E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004C78F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 004C7901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 004C7910
LocalFree.KERNEL32(00000000), ref: 004C7917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 004C7933
GetAce.ADVAPI32(?,00000000,?), ref: 004C7963
EqualSid.ADVAPI32(?,004C7F63), ref: 004C798A
DeleteAce.ADVAPI32(?,00000000), ref: 004C79A3
EqualSid.ADVAPI32(?,004C7F63), ref: 004C79C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 004C7A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004C7A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 004C7A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 004C7A79
LocalFree.KERNEL32(00000000), ref: 004C7A87

Strings

D, xrefs: 004C785C

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 8acbe921d2a9653fc26c1c3154f4d2a5aa53819134126722fc4745efa9ed4f46
Instruction ID: bb3cdfcc5c8839d48b68877ec88b4fff277697f14a991773c910a94c12d05310
Opcode Fuzzy Hash: 8acbe921d2a9653fc26c1c3154f4d2a5aa53819134126722fc4745efa9ed4f46
Instruction Fuzzy Hash: 1C814AB5905219ABDF62CFA4DD44FEFBBB8EF08340F14416AE505E2250D7398A41CF68

Function 004C8328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004C83F3
RegQueryValueExA.KERNELBASE(004D0750,?,00000000,?,004C8893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004C8414
RegSetValueExA.KERNELBASE(004D0750,?,00000000,00000004,004C8893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004C8441
RegCloseKey.ADVAPI32(004D0750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004C844A

Strings

localcfg, xrefs: 004C8348
C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 004C85C8, 004C85D5, 004C85E5

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe$localcfg
API String ID: 237177642-3670105814
Opcode ID: 2194b7afdfbda0020fc7e227bc202895090f61bb7adef290ccedea8bef5bf868
Instruction ID: 1f7923630974279b9b105d29152d64afbd608d5f2405c21649a262ddd3a612cd
Opcode Fuzzy Hash: 2194b7afdfbda0020fc7e227bc202895090f61bb7adef290ccedea8bef5bf868
Instruction Fuzzy Hash: CFC1BFB9941109BEEB51ABA1DC85FFF7BBCEB14304F14446FF500A2151EBB84E448B29

Function 004C1D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 004C1DC6
GetSystemInfo.KERNELBASE(?), ref: 004C1DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 004C1E03
GetProcAddress.KERNEL32(00000000), ref: 004C1E0A
GetCurrentProcess.KERNEL32(?), ref: 004C1E1B
GetTickCount.KERNEL32 ref: 004C1FC9

Part of subcall function 004C1BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 004C1C15

Strings

kernel32, xrefs: 004C1DF7
start_srv, xrefs: 004C1E6C
localcfg, xrefs: 004C1E2A, 004C1E31, 004C1E44, 004C1E7D, 004C1E8C, 004C1EB2, 004C1ED1, 004C1EE7, 004C1EFF, 004C1F1C, 004C1F34, 004C1F50, 004C1F70
lid_file_upd, xrefs: 004C1E25
loader_id, xrefs: 004C1F4B, 004C1F6B
hi_id, xrefs: 004C1F16, 004C1F1B, 004C1F33
IsWow64Process, xrefs: 004C1DF2
work_srv, xrefs: 004C1E5E
flags_upd, xrefs: 004C1E3E, 004C1E43, 004C1E7C
born_date, xrefs: 004C1EAD, 004C1ECC
net_type, xrefs: 004C1E87

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 23a3ee1c19b32b2a7bdea0fe0dc94892d0b1c56ce3f9b9d5b8f6280513bcc846
Instruction ID: be44684a5d79c70be11013badcb5d67442974d2e9173c6ecd2242b35859a4909
Opcode Fuzzy Hash: 23a3ee1c19b32b2a7bdea0fe0dc94892d0b1c56ce3f9b9d5b8f6280513bcc846
Instruction Fuzzy Hash: 235195B49043446FE3B0AF768C85F2B7AECEB55708F04492FB94683253D77DA9048769

Function 004C73FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 004C7472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004C74F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 004C7528
___ascii_stricmp.LIBCMT ref: 004C764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004C76E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 004C7706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004C7717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 004C7745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004C77EF

Part of subcall function 004CF1A5: lstrlenA.KERNEL32(000000C8,000000E4,004D22F8,000000C8,004C7150,?), ref: 004CF1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 004C778F
RegCloseKey.KERNELBASE(?), ref: 004C77E6

Strings

", xrefs: 004C7599

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 79560e82c82d19570009996dd84836467f404d8bc0b51fb9d8f3344adf34f6de
Instruction ID: b3fd2d6ad0afa54d0c24b1ebf8771612cf54dc2818dbf12b8392dc53a9debc23
Opcode Fuzzy Hash: 79560e82c82d19570009996dd84836467f404d8bc0b51fb9d8f3344adf34f6de
Instruction Fuzzy Hash: 62C1B079904209BBDB519BA5DC45FEFBBB9EF44310F1000AFF504A6291EB789A408F68

Function 004C675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 004C677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 004C679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004C67B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004C67BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004C67D3
ReadFile.KERNELBASE(000000FF,?,00000040,004C8244,00000000,?,75920F10,00000000), ref: 004C6807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 004C681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 004C683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 004C685C
ReadFile.KERNEL32(000000FF,?,00000028,004C8244,00000000,?,75920F10,00000000), ref: 004C688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 004C6906
ReadFile.KERNEL32(000000FF,?,00000000,004C8244,00000000,?,75920F10,00000000), ref: 004C691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,75920F10,00000000), ref: 004C6971

Part of subcall function 004CEC2E: GetProcessHeap.KERNEL32(00000000,'L,00000000,004CEA27,00000000), ref: 004CEC41
Part of subcall function 004CEC2E: RtlFreeHeap.NTDLL(00000000), ref: 004CEC48

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 5d3e005705b349f67ce69c0f2446ea59b372afb959a3e0fb8d32f1294bdbbb95
Instruction ID: bf5922110d18c6c11a0b709b3d194403ecf5d6cf75bca7b1e40bc5a00df5f1d2
Opcode Fuzzy Hash: 5d3e005705b349f67ce69c0f2446ea59b372afb959a3e0fb8d32f1294bdbbb95
Instruction Fuzzy Hash: F47166B5C0121DEFDF509FA5CC80EEEBBB8FB04314F10856AE515A2290E7349E92CB64

Function 004CF315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(004CCA1D), ref: 004CF34D
socket.WS2_32(00000002,00000001,00000000), ref: 004CF367
closesocket.WS2_32(00000000), ref: 004CF375

Strings

time_cfg, xrefs: 004CF323

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 83b7ab5e6058df1727f1f1487a53e0c149fc0779a24516ebd56f4b1ef58bf84e
Instruction ID: c39220a23dd9690d3b521b19f658dac224943257093026e3e1051e97238cc6b1
Opcode Fuzzy Hash: 83b7ab5e6058df1727f1f1487a53e0c149fc0779a24516ebd56f4b1ef58bf84e
Instruction Fuzzy Hash: 74318976901118ABDB109FA5DC89EEF7BBDEF88314F10417BF904E3151E7388A458BA9

Function 004C405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 004C4070
ExitProcess.KERNEL32 ref: 004C4121

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 8b6a2896d3d71baaa961411df4dff926d4c3680ed32d04b60a71cf3e83e3e911
Instruction ID: 36d6b8290b0bc396220fa67845fc18102dd17452b85ea6109ce16c45703e0ade
Opcode Fuzzy Hash: 8b6a2896d3d71baaa961411df4dff926d4c3680ed32d04b60a71cf3e83e3e911
Instruction Fuzzy Hash: 9F51B379D40218BAEB61ABA19D46FFF7B7CEB51754F00406EF600A2180E7388E41C769

Function 004C2D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,004C2F01,?,004C20FF,004D2000), ref: 004C2D3A
LoadLibraryA.KERNEL32(?), ref: 004C2D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 004C2D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 004C2D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 004C2D99
HeapAlloc.KERNEL32(00000000), ref: 004C2DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 004C2DCB

Strings

dnsapi.dll, xrefs: 004C2D29
DnsQuery_A, xrefs: 004C2D5B

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: a983b52d9c65033a1cf2640e5bab25d649244df21b7f1cf72c93b882e288ba58
Instruction ID: 06294e99192087418dbae00ac9651e2b847475669d1d77a227148aa392dd9859
Opcode Fuzzy Hash: a983b52d9c65033a1cf2640e5bab25d649244df21b7f1cf72c93b882e288ba58
Instruction Fuzzy Hash: 61218E75901226ABCB629F54DD44FAFBBB8EF18B51F10402BF906E3210D7F4998287D8

Function 004C80C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004C815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,004CA45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004C8187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,004CA45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004C81BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004C8210

Part of subcall function 004C675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 004C677E
Part of subcall function 004C675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 004C679A
Part of subcall function 004C675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004C67B0
Part of subcall function 004C675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004C67BF
Part of subcall function 004C675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004C67D3
Part of subcall function 004C675C: ReadFile.KERNELBASE(000000FF,?,00000040,004C8244,00000000,?,75920F10,00000000), ref: 004C6807
Part of subcall function 004C675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 004C681F
Part of subcall function 004C675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 004C683E
Part of subcall function 004C675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 004C685C

Part of subcall function 004CEC2E: GetProcessHeap.KERNEL32(00000000,'L,00000000,004CEA27,00000000), ref: 004CEC41
Part of subcall function 004CEC2E: RtlFreeHeap.NTDLL(00000000), ref: 004CEC48

Strings

C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe, xrefs: 004C8225, 004C823A

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe
API String ID: 124786226-2804431639
Opcode ID: a6ce23b9b4dad802ff40be461632070619f3a511a897373ba9fd29396c205121
Instruction ID: b30c12d9c3a2a0153eba5087d79327ef05d23534c6a313614d966301ad95166d
Opcode Fuzzy Hash: a6ce23b9b4dad802ff40be461632070619f3a511a897373ba9fd29396c205121
Instruction Fuzzy Hash: A841A0BA801108BFEB50EBA19D85FBF77ACAB10304F1448AFF500A3101EA785E458B29

Function 004C1AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 004C1AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 004C1AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 004C1B20

Strings

GetAdaptersAddresses, xrefs: 004C1AE3
Iphlpapi.dll, xrefs: 004C1ACC

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: bcfeb8351b26dd430fb932425aad04a11a0da05162be3e1ca80fc0f9546dfa68
Instruction ID: e7945856197881a6cb1cfc5fa4cd2432ed7d16091f95d92a7f78ff44ed4fe2fe
Opcode Fuzzy Hash: bcfeb8351b26dd430fb932425aad04a11a0da05162be3e1ca80fc0f9546dfa68
Instruction Fuzzy Hash: 6711EB79E01124AFCB55D765CC84EAEFB79EB45B10B14405FE005A3222F6346D40CF88

Function 004CE3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,004CE5F2,00000000,00020119,004CE5F2,004D22F8), ref: 004CE3E6
RegQueryValueExA.ADVAPI32(004CE5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 004CE44E
RegQueryValueExA.ADVAPI32(004CE5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 004CE482
RegQueryValueExA.ADVAPI32(004CE5F2,?,00000000,?,80000001,?), ref: 004CE4CF
RegCloseKey.ADVAPI32(004CE5F2,?,?,?,?,000000C8,000000E4), ref: 004CE520

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 649f5f8e5a92648f686a7a720046e11813166255c8a428176089064178d52309
Instruction ID: b8f8f3aefaf37dabc84abe4e5425037d6d19e8adfe8c8a01e34f08387a3e04f5
Opcode Fuzzy Hash: 649f5f8e5a92648f686a7a720046e11813166255c8a428176089064178d52309
Instruction Fuzzy Hash: 5D4116B6D00219BFEF519FD5DC85EEEBBB9EB04308F04406AE900A3250E7359E158B64

Function 004CF26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 004CF2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 004CF2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 004CF2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 004CF2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 004CF2FD

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 81807dddde636a90fe62178a9dc5666e0de447ff30f643ca3f14807382342287
Instruction ID: 7020d5dd1ac2147338e7c1a5463582ea88f23728a87cc5fff590694fd726f095
Opcode Fuzzy Hash: 81807dddde636a90fe62178a9dc5666e0de447ff30f643ca3f14807382342287
Instruction Fuzzy Hash: EE11F8B2A40248BAEB11DF94CD85F9E7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 004C1BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004C1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 004C1AD4
Part of subcall function 004C1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 004C1AE9
Part of subcall function 004C1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 004C1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 004C1C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 004C1C51

Strings

localcfg, xrefs: 004C1BE7
hi_id, xrefs: 004C1BE5

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: a392e8fcad37e42b50e6c937fd3c7a9f95ec119a41c5a9110bd4f2d3238b1011
Instruction ID: fc03980164d26091c2db3cd27fd538b48fdc75ed6ec25112f80e5056ac859d8f
Opcode Fuzzy Hash: a392e8fcad37e42b50e6c937fd3c7a9f95ec119a41c5a9110bd4f2d3238b1011
Instruction Fuzzy Hash: 20018476940118BBEB50DAE8C8C5EFFBBBCE745745F10047BE602E3211D1349D448665

Function 004C1B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 004C1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 004C1AD4
Part of subcall function 004C1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 004C1AE9
Part of subcall function 004C1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 004C1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 004C1BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,004C1EFD,00000000,00000000,00000000,00000000), ref: 004C1BB8

Strings

localcfg, xrefs: 004C1B7B

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: fa51b747c8af020cb4c59680d727b0a96ed43b6b13f4e56d8a4b5cca5ff97612
Instruction ID: 763ed7ec511304c39427c2b0a6000081a4a4114eee7059e898d76135b2beb928
Opcode Fuzzy Hash: fa51b747c8af020cb4c59680d727b0a96ed43b6b13f4e56d8a4b5cca5ff97612
Instruction Fuzzy Hash: 25018BB6D00108BFEB01ABE9CC81EEFFBBCEB48654F150066A601E3151E6706E084AA0

Function 004C2684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 004C2693
gethostbyname.WS2_32(00000001), ref: 004C269F

Strings

time_cfg, xrefs: 004C2684

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 6486d3924a99b119a27ff4ebf1cf9ac6b93f1092382cfccfc070afd42fecdcbc
Instruction ID: ca9bee86f090582709e2f901dec703f6204462fe90764606b7f77a3b573f81d4
Opcode Fuzzy Hash: 6486d3924a99b119a27ff4ebf1cf9ac6b93f1092382cfccfc070afd42fecdcbc
Instruction Fuzzy Hash: 3FE08C342060218FCB909B28F848F8A37A4AF16330F01418AF480C72A0C7B4DC8097A8

Function 004CEC2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004CEBA0: GetProcessHeap.KERNEL32(00000000,00000000,004CEC0A,00000000,80000001,?,004CDB55,7FFF0001), ref: 004CEBAD
Part of subcall function 004CEBA0: HeapSize.KERNEL32(00000000,?,004CDB55,7FFF0001), ref: 004CEBB4

GetProcessHeap.KERNEL32(00000000,'L,00000000,004CEA27,00000000), ref: 004CEC41
RtlFreeHeap.NTDLL(00000000), ref: 004CEC48

Strings

'L, xrefs: 004CEC2F, 004CEC37, 004CEC3E

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID: 'L
API String ID: 1305341483-3688640772
Opcode ID: c7ee7a45117c9cf5c8d83703ef37cd71fc30d4634c2a11b36743667587a83fe6
Instruction ID: c8902f186d44ec25d74ca9e5fd1b13c928a0b77e6b237237861398353d4e962b
Opcode Fuzzy Hash: c7ee7a45117c9cf5c8d83703ef37cd71fc30d4634c2a11b36743667587a83fe6
Instruction Fuzzy Hash: 79C012324072306BC5912751BC0DFAF6B189F46711F0D441FF4056715487645C4086E9

Function 004CE52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004CDD05: GetTickCount.KERNEL32 ref: 004CDD0F
Part of subcall function 004CDD05: InterlockedExchange.KERNEL32(004D36B4,00000001), ref: 004CDD44
Part of subcall function 004CDD05: GetCurrentThreadId.KERNEL32 ref: 004CDD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,004CA445), ref: 004CE558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,75920F10,?,00000000,?,004CA445), ref: 004CE583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,004CA445), ref: 004CE5B2

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 84b6b8c2677051e950257a7dab722b0328a5874d57545aea913f21659fd819de
Instruction ID: 6db93406f7f5bccfbfd025f98ae7b8f6c0e05b20d94455add2f8b0bcdba9ae11
Opcode Fuzzy Hash: 84b6b8c2677051e950257a7dab722b0328a5874d57545aea913f21659fd819de
Instruction Fuzzy Hash: 1F21EAB69402007AE2A17A635D07F6B3E5CDB54758F10052FFE09A12E3EB9DE91081BD

Function 004C877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 004C88A5

Part of subcall function 004CF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,004CE342,00000000,7508EA50,80000001,00000000,004CE513,?,00000000,00000000,?,000000E4), ref: 004CF089
Part of subcall function 004CF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,004CE342,00000000,7508EA50,80000001,00000000,004CE513,?,00000000,00000000,?,000000E4,000000C8), ref: 004CF093

Strings

localcfg, xrefs: 004C87CA, 004C87CF, 004C87FB, 004C8835, 004C8861
rresolv, xrefs: 004C87F6, 004C885C

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: ff07bbe4faf36107e8122dd1c9ac3397b42f0504d185dbdeee94644fe84cc53c
Instruction ID: 061eadf69b191834441f7436fe5f3f034f8bcf8a92b5501c9566cece7c16e624
Opcode Fuzzy Hash: ff07bbe4faf36107e8122dd1c9ac3397b42f0504d185dbdeee94644fe84cc53c
Instruction Fuzzy Hash: FB21C4391493006AF395B7676E47FAA3BE9DB10B14FA0482FF904961C3EEDD854441BD

Function 004C4000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004D22F8,004C42B6,00000000,00000001,004D22F8,00000000,?,004C98FD), ref: 004C4021
GetLastError.KERNEL32(?,004C98FD,00000001,00000100,004D22F8,004CA3C7), ref: 004C402C
Sleep.KERNEL32(000001F4,?,004C98FD,00000001,00000100,004D22F8,004CA3C7), ref: 004C4046

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 126130671b69d94768e0de383a77aed4403bf9980874d4aa2bf84be8431f7eb5
Instruction ID: 7c296a97e488d6e6a93d18eb2a170f1dbe5952c0175c34ba2904f80eced29672
Opcode Fuzzy Hash: 126130671b69d94768e0de383a77aed4403bf9980874d4aa2bf84be8431f7eb5
Instruction Fuzzy Hash: 9BF0A7352801016AD7724B26BD59F1B37A1DBC2724F254B2EF3B5E31E0C63448819B1D

Function 004CDB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(004CDC19,?,00000104), ref: 004CDB7F
lstrcpyA.KERNEL32(?,004D28F8), ref: 004CDBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 004CDBC2

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: a1721f348d829c7e0b06347378a14b8c0e5a3a5fcffe4b520ab31fc732df989a
Instruction ID: 06a32206bd6f374b33328171adaa1cc9e5f6f3da8034625a2327b5708c2087cf
Opcode Fuzzy Hash: a1721f348d829c7e0b06347378a14b8c0e5a3a5fcffe4b520ab31fc732df989a
Instruction Fuzzy Hash: D8F09070500209BBEF119F64EC89FD93B69AB10308F1041A5BB55A50D0D7F2E945CB28

Function 004CEC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 004CEC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 004CEC72
GetTickCount.KERNEL32 ref: 004CEC78

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 8ff3c7fc207da01957c465a6b1dc029bcf877f76f121244bbac8a9dab925e4a4
Instruction ID: 51d59fdee966cb44e6c165f5d13a9b9d09c9ef9c175f831c056677bc20e2d91f
Opcode Fuzzy Hash: 8ff3c7fc207da01957c465a6b1dc029bcf877f76f121244bbac8a9dab925e4a4
Instruction Fuzzy Hash: A9E09AF5811104BFE711ABB0EC4AE6F77BCEB08215F500661B911D6090DA709A058B64

Function 004C30B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 004C30D8
gethostbyname.WS2_32(?), ref: 004C30E2

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: c028fc20f5799f5491a3b7f9712b1c4edd6a1a68f0e5b715d797cae008ce898a
Instruction ID: 008f96053f4b2361c10cb5ada43a85a606c77b089e0523e4a8842f905637bd90
Opcode Fuzzy Hash: c028fc20f5799f5491a3b7f9712b1c4edd6a1a68f0e5b715d797cae008ce898a
Instruction Fuzzy Hash: DCE09B769011199BCF00DBA8EC89F9B77ECFF04308F084066F905E3255EA34E9048794

Function 004CEBED Relevance: 3.0, APIs: 2, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,7FFF0001,80000001,?,004CDB55,7FFF0001), ref: 004CEC13
RtlReAllocateHeap.NTDLL(00000000,?,004CDB55,7FFF0001), ref: 004CEC1A

Part of subcall function 004CEBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,004CEBFE,7FFF0001,?,004CDB55,7FFF0001), ref: 004CEBD3
Part of subcall function 004CEBCC: RtlAllocateHeap.NTDLL(00000000,?,004CDB55,7FFF0001), ref: 004CEBDA

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 767421176c7de718add4fc5283e6cc8c4559ae24c97f950ade2b871c768b4001
Instruction ID: a6d7f48fcd2e299f916045722a1a5bff2f8bdfe8b35d74ceb0d998316be63305
Opcode Fuzzy Hash: 767421176c7de718add4fc5283e6cc8c4559ae24c97f950ade2b871c768b4001
Instruction Fuzzy Hash: 56E012361052187ADF412B96EC09FAD7B59DB04365F14802AF90D49161DB369990D698

Function 004CEBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,004CEBFE,7FFF0001,?,004CDB55,7FFF0001), ref: 004CEBD3
RtlAllocateHeap.NTDLL(00000000,?,004CDB55,7FFF0001), ref: 004CEBDA

Part of subcall function 004CEB74: GetProcessHeap.KERNEL32(00000000,00000000,004CEC28,00000000,?,004CDB55,7FFF0001), ref: 004CEB81
Part of subcall function 004CEB74: HeapSize.KERNEL32(00000000,?,004CDB55,7FFF0001), ref: 004CEB88

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: f5545c5ec4272c84696421c470d2b0958f2b75df3b4b21eafbd0d624c0a17144
Instruction ID: 0101197cdf3902b652cba7fd1fb05ae5e1ab00a5343cbb020bfd8a9837907b4f
Opcode Fuzzy Hash: f5545c5ec4272c84696421c470d2b0958f2b75df3b4b21eafbd0d624c0a17144
Instruction Fuzzy Hash: 83C0803610523067C64127A57C0CF9E7F54DF05352F08001AF505C3160C7354C4087A9

Function 004CF43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,004CCA44), ref: 004CF476

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: d20e055c3b3a77b6b43181ba240d60e8070aa15aee6ad586c7d80f15b65a5359
Instruction ID: 370582eb186bdd336a1e2efebd7fcb75617cf3b7639b992488765f5d94044c71
Opcode Fuzzy Hash: d20e055c3b3a77b6b43181ba240d60e8070aa15aee6ad586c7d80f15b65a5359
Instruction Fuzzy Hash: AFF08C3620154AAB9B419E9ADC84DAB3BAEFB99310B050137FA04D3110D639E825CBA8

Function 004C1978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 004C1992

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 4cb469fcc944aa9858e614e28a890652cbbb4d370db0628398c54c03e8584945
Instruction ID: 1932f31a2154ba366c4d7cea5e076c16a83120925415a3d87734f0688273bce8
Opcode Fuzzy Hash: 4cb469fcc944aa9858e614e28a890652cbbb4d370db0628398c54c03e8584945
Instruction Fuzzy Hash: 91D0222A1092312A42402359BC04A7FAB8CCF05262B00802FFC48C0120C638CC41839D

Function 004CDD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 004CDDB5

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 9a6a5fac6c1e8b6e35a4547a9f168245bdbb8650cb7a4bf06cd0a95b113d7800
Instruction ID: 574e18dcee573c768c38ef747d77807550a201aa4462f4736a0d8ee488d79d75
Opcode Fuzzy Hash: 9a6a5fac6c1e8b6e35a4547a9f168245bdbb8650cb7a4bf06cd0a95b113d7800
Instruction Fuzzy Hash: 0EF05839E003029BCBA18E249984B67B7E8AB85325F14483FE25A92250DB38DC45CB1A

Non-executed Functions

Function 004C637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,004C9816,EntryPoint), ref: 004C638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,004C9816,EntryPoint), ref: 004C63A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004C63CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004C63EB

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: a94449a7bf0ac5f898afbabb7d68dcc3216b5d717c842f47f77af8b1009c06b5
Instruction ID: 4c66a08ce49fd29e37a8ddcc9ae786a82abf9ad6c992e1763ebecde160e60748
Opcode Fuzzy Hash: a94449a7bf0ac5f898afbabb7d68dcc3216b5d717c842f47f77af8b1009c06b5
Instruction Fuzzy Hash: 3211E3B5600219BFDB518F65DC09F9B3BA8EB047A4F01806AFD08E7290D671DC008AB8

Function 004C1000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,004C1839,004C9646), ref: 004C1012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004C10C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004C10E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 004C1101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 004C1121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 004C1140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 004C1160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 004C1180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 004C119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004C11BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004C11DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004C11FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 004C121A

Strings

RtlInitUnicodeString, xrefs: 004C1135
NtFilterToken, xrefs: 004C122B
RtlFreeSid, xrefs: 004C1116
RtlSetLastWin32Error, xrefs: 004C10D6
NtClose, xrefs: 004C11B4
RtlLengthSid, xrefs: 004C1246
NtDuplicateToken, xrefs: 004C11F3
NtTerminateProcess, xrefs: 004C10F6
RtlNtStatusToDosError, xrefs: 004C1194
NtSetInformationThread, xrefs: 004C1155
NtOpenProcessToken, xrefs: 004C11D4
NtQueryInformationToken, xrefs: 004C1262
RtlExpandEnvironmentStrings_U, xrefs: 004C10BC
NtSetInformationToken, xrefs: 004C1175
RtlAllocateAndInitializeSid, xrefs: 004C120F
ntdll.dll, xrefs: 004C100D

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: e4d9be6713f9d57c2ef0e63569ad49677bb98de508f22834fc43d2d31264048e
Instruction ID: c668310532dc64a97f5cf1bd553e62826475e492c55dbbed7dbb65cfcc53cadb
Opcode Fuzzy Hash: e4d9be6713f9d57c2ef0e63569ad49677bb98de508f22834fc43d2d31264048e
Instruction Fuzzy Hash: 11513EB9643601A6D7518F69EC64B5637E86749322F1403BB9420D23F1D7F8CA82CB9E

Function 004CB211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 004CB2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 004CB2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 004CB2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 004CB2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 004CB31A
GetTimeZoneInformation.KERNEL32(?), ref: 004CB329
wsprintfA.USER32 ref: 004CB3B7

Strings

Nov, xrefs: 004CB29C
Jan, xrefs: 004CB256
Mon, xrefs: 004CB22C
May, xrefs: 004CB272
Sep, xrefs: 004CB28E
Dec, xrefs: 004CB2A3
Jul, xrefs: 004CB280
Fri, xrefs: 004CB248
Oct, xrefs: 004CB295
Jun, xrefs: 004CB279
Tue, xrefs: 004CB233
Feb, xrefs: 004CB25D
Mar, xrefs: 004CB264
Thu, xrefs: 004CB241
Sun, xrefs: 004CB225
Wed, xrefs: 004CB23A
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 004CB3AF
Apr, xrefs: 004CB26B
Sat, xrefs: 004CB24F
Aug, xrefs: 004CB287

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 5f8c4e5a4c32ba0287c5a65017c4b7934668f8aec6c7dceb8c964a738ba1c594
Instruction ID: 2de09d58191dca095938e22a9ae72a69589d7d14fe07a32c22f762dde70d8526
Opcode Fuzzy Hash: 5f8c4e5a4c32ba0287c5a65017c4b7934668f8aec6c7dceb8c964a738ba1c594
Instruction Fuzzy Hash: C4519475D1021CAACF58CFD5D859AEEBBB9FF49704F10812BE501B7250D3784A89CB98

Function 004C6511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004C654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 004C655C
htonl.WS2_32(?), ref: 004C6578
htonl.WS2_32(?), ref: 004C6587
wsprintfA.USER32 ref: 004C659B
wsprintfA.USER32 ref: 004C65DC
wsprintfA.USER32 ref: 004C6671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 004C668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 004C6696
wsprintfA.USER32 ref: 004C66B0
wsprintfA.USER32 ref: 004C66E7
wsprintfA.USER32 ref: 004C66FF
wsprintfA.USER32 ref: 004C671F
ExitProcess.KERNEL32 ref: 004C6755

Strings

except_info, xrefs: 004C6728
%d=%p, xrefs: 004C66F9
localcfg, xrefs: 004C672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004C65D6
12:08:32, xrefs: 004C6535
va=%08X%08X uef=%p, xrefs: 004C6595
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 004C666B
Jan 13 2018, xrefs: 004C653A
plgs:, xrefs: 004C66AA
ver=%d date=%s %sc=%08x a=%p, xrefs: 004C6547

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 81ee6a296748b113edc01b91e8df94f0497196f280d2c8ddea31eb2a2736e0cb
Instruction ID: 08466d0a77727deacca4fce7701f43a19679ceaeb12d9ce4c95e4fcca328044d
Opcode Fuzzy Hash: 81ee6a296748b113edc01b91e8df94f0497196f280d2c8ddea31eb2a2736e0cb
Instruction Fuzzy Hash: B1615E72A50208AFDB609FB4DC45FEA77E9FF08300F24806AF959D3261DA75A9508F54

Function 004CA7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004CA7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 004CA87E
send.WS2_32(00000000,?,00000000,00000000), ref: 004CA893
wsprintfA.USER32 ref: 004CA8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 004CA8D2
wsprintfA.USER32 ref: 004CA8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 004CA97C
wsprintfA.USER32 ref: 004CA9B9

Strings

mail from:<%s>, xrefs: 004CA848
rcpt to:<%s>, xrefs: 004CA855
Incorrect respons, xrefs: 004CAB39
ehlo %s, xrefs: 004CA7F5
Too small respons, xrefs: 004CA9C9
., xrefs: 004CA8CA
Too big smtp respons (%d bytes), xrefs: 004CA9B1
localcfg, xrefs: 004CAB0B
quit, xrefs: 004CA86C
AUTH LOGIN, xrefs: 004CA80C
ESMTP, xrefs: 004CAA38
helo %s, xrefs: 004CA803
data, xrefs: 004CA85E
Error sending command (sent = %d/%d), xrefs: 004CA8A7, 004CA8DA

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: b0678bdda8376edec3c28d472ff81923876d6eecc44096ff873ad45b8b10a4bc
Instruction ID: eabfe6d9a3aac16ce7d84e4b66b7844cd59ef61059db42f635da00b5a18d0494
Opcode Fuzzy Hash: b0678bdda8376edec3c28d472ff81923876d6eecc44096ff873ad45b8b10a4bc
Instruction Fuzzy Hash: D9A1067994420DABDFA09A54DC85FAE3769AB0030CF24042FFA01A7290EA3D9D65875F

Function 004C1280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 004C139A
lstrlenW.KERNEL32(-00000003), ref: 004C1571

Strings

wusa.exe, xrefs: 004C1388
PDGu, xrefs: 004C139A
useless, xrefs: 004C161E
@, xrefs: 004C1380
%systemroot%\system32\cmd.exe, xrefs: 004C1316
<, xrefs: 004C1378
uac, xrefs: 004C1628
D, xrefs: 004C15C6
, xrefs: 004C1462

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 75eb81d155013a44510108f1c96a40290daa185f97b8ee31f65580d9439f0e6e
Instruction ID: dd103374a7a69ceaf279e97ca421394ce0be0e8e196f123d699d5ff99724a3ea
Opcode Fuzzy Hash: 75eb81d155013a44510108f1c96a40290daa185f97b8ee31f65580d9439f0e6e
Instruction Fuzzy Hash: D1F19AB92093419FD320DF64C888F6BB7E4FB8A304F10492EF586973A1D7789945CB5A

Function 004C2A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 004C2A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 004C2A86
socket.WS2_32(00000002,00000002,00000011), ref: 004C2AA0
htons.WS2_32(00000000), ref: 004C2ADB
select.WS2_32 ref: 004C2B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 004C2B4A
htons.WS2_32(?), ref: 004C2B71
htons.WS2_32(?), ref: 004C2B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 004C2BFB

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: f51a4e5e2d09b5c9ef50e4bcf79cdc3fba603980c3cf15c51f56a7059582b510
Instruction ID: cafd4fdd25b6662c9d656fa5875774a6e59ef40afaa90cd2ae709f58ff88c70d
Opcode Fuzzy Hash: f51a4e5e2d09b5c9ef50e4bcf79cdc3fba603980c3cf15c51f56a7059582b510
Instruction Fuzzy Hash: CB61ED759053159BC760AF65DE08F2FBBE8FB89744F04081FF84597250D7F998408BAA

Function 004C704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004C70C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 004C719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 004C71B2
RegCloseKey.ADVAPI32(75920F10), ref: 004C7208
RegCloseKey.ADVAPI32(75920F10), ref: 004C7291
___ascii_stricmp.LIBCMT ref: 004C72C2
RegCloseKey.ADVAPI32(75920F10), ref: 004C72D0
RegCloseKey.ADVAPI32(75920F10), ref: 004C7314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 004C738D
RegCloseKey.ADVAPI32(75920F10), ref: 004C73D8

Part of subcall function 004CF1A5: lstrlenA.KERNEL32(000000C8,000000E4,004D22F8,000000C8,004C7150,?), ref: 004CF1AD

Strings

", xrefs: 004C7227
, xrefs: 004C7194

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 6f7eda01279dd9b268d9736154a1aa3d5bdecbf5af0c1483a9bc9c5a2dc0616c
Instruction ID: 94181ce953895b0dc587094da0ad521b5cfeef655ea2ddbf7cfe63569fb6bfe6
Opcode Fuzzy Hash: 6f7eda01279dd9b268d9736154a1aa3d5bdecbf5af0c1483a9bc9c5a2dc0616c
Instruction Fuzzy Hash: 83B18C76908209BBDB559FA1DC45FEF77B8EB04304F10046FF901E2291EB799A84CB68

Function 004CAD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004CAD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 004CADA6

Part of subcall function 004CAD08: gethostname.WS2_32(?,00000080), ref: 004CAD1C
Part of subcall function 004CAD08: lstrlenA.KERNEL32(00000000), ref: 004CAD60
Part of subcall function 004CAD08: lstrlenA.KERNEL32(00000000), ref: 004CAD69
Part of subcall function 004CAD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 004CAD7F

Part of subcall function 004C30B5: gethostname.WS2_32(?,00000080), ref: 004C30D8
Part of subcall function 004C30B5: gethostbyname.WS2_32(?), ref: 004C30E2

wsprintfA.USER32 ref: 004CAEA5

Part of subcall function 004CA7A3: inet_ntoa.WS2_32(?), ref: 004CA7A9

wsprintfA.USER32 ref: 004CAE4F
wsprintfA.USER32 ref: 004CAE5E

Part of subcall function 004CEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 004CEF92
Part of subcall function 004CEF7C: lstrlenA.KERNEL32(?), ref: 004CEF99
Part of subcall function 004CEF7C: lstrlenA.KERNEL32(00000000), ref: 004CEFA0

Strings

----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 004CAE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 004CAE9F
%OUTLOOK_HST, xrefs: 004CAEC5
%s%d, xrefs: 004CAE58
%OUTLOOK_MID, xrefs: 004CAEAE
%OUTLOOK_BND_, xrefs: 004CAE0F, 004CAE14, 004CAE57, 004CAE76
127.0.0.1, xrefs: 004CADEB

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 11534b5893d6152d82265e1b6ce003e3d5b569ecf2bead75ea63c533b48218cf
Instruction ID: d234995a2367e4c74b20424874586e35c73d65fa3da11884c17419cef30dd055
Opcode Fuzzy Hash: 11534b5893d6152d82265e1b6ce003e3d5b569ecf2bead75ea63c533b48218cf
Instruction Fuzzy Hash: 644150B690020C6BDB25AFA1DC45FEE3BADFB08304F14442FB91592151EB79E5148B55

Function 004C2DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 004C2E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2E4C
HeapAlloc.KERNEL32(00000000,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2E4F
htons.WS2_32(00000035), ref: 004C2E88
inet_addr.WS2_32(?), ref: 004C2E93
gethostbyname.WS2_32(?), ref: 004C2EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2EE3
HeapFree.KERNEL32(00000000,?,00000000,004C2F0F,?,004C20FF,004D2000), ref: 004C2EE6

Strings

iphlpapi.dll, xrefs: 004C2DFB, 004C2E00, 004C2E10
GetNetworkParams, xrefs: 004C2E28

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 53a25f57b9eaada15a50bfcd634d2532699ef92a6b04ef59fc640d39ffb23ba2
Instruction ID: 72f98568f992aba39c0864957b8b1a5a318112836e5b7174996e812825a85be6
Opcode Fuzzy Hash: 53a25f57b9eaada15a50bfcd634d2532699ef92a6b04ef59fc640d39ffb23ba2
Instruction Fuzzy Hash: 4931B139A0120AABDB519BB89D48F6F77B8AF05360F14012BE914F7390DBF8D9418B5C

Function 004C9326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,004C9DD7,?,00000022,?,?,00000000,00000001), ref: 004C9340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,004C9DD7,?,00000022,?,?,00000000,00000001), ref: 004C936E
GetModuleFileNameA.KERNEL32(00000000,?,004C9DD7,?,00000022,?,?,00000000,00000001), ref: 004C9375
wsprintfA.USER32 ref: 004C93CE
wsprintfA.USER32 ref: 004C940C
wsprintfA.USER32 ref: 004C948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004C94F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 004C9526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 004C9571

Strings

runas, xrefs: 004C9674

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: e1a3b1b4c7f3ec3bcfae25919146c658c74a8f5c16e5939fcfb971e43de7c4dc
Instruction ID: 7311013488d10516a1c5206dd7b59cb69d430209e4de0418194247aacd54144e
Opcode Fuzzy Hash: e1a3b1b4c7f3ec3bcfae25919146c658c74a8f5c16e5939fcfb971e43de7c4dc
Instruction Fuzzy Hash: 6BA172B6540248FBEB659FA1CC49FDF37ACEB04744F10402BFA0592291D7B9D944CBA9

Function 004C2011 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C2078
GetTickCount.KERNEL32 ref: 004C20D4
GetTickCount.KERNEL32 ref: 004C20DB
GetTickCount.KERNEL32 ref: 004C212B
GetTickCount.KERNEL32 ref: 004C2132
GetTickCount.KERNEL32 ref: 004C2142

Part of subcall function 004CF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,004CE342,00000000,7508EA50,80000001,00000000,004CE513,?,00000000,00000000,?,000000E4), ref: 004CF089
Part of subcall function 004CF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,004CE342,00000000,7508EA50,80000001,00000000,004CE513,?,00000000,00000000,?,000000E4,000000C8), ref: 004CF093

Part of subcall function 004CE854: lstrcpyA.KERNEL32(00000001,?,?,004CD8DF,00000001,localcfg,except_info,00100000,004D0264), ref: 004CE88B
Part of subcall function 004CE854: lstrlenA.KERNEL32(00000001,?,004CD8DF,00000001,localcfg,except_info,00100000,004D0264), ref: 004CE899

Part of subcall function 004C1C5F: wsprintfA.USER32 ref: 004C1CE1

Strings

rbl_ip, xrefs: 004C218F
hl>, xrefs: 004C20DD, 004C212D
localcfg, xrefs: 004C2070, 004C2160, 004C2186, 004C2194, 004C21E4
rbl_bl, xrefs: 004C2181
net_type, xrefs: 004C21DF

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: hl>$localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-459385573
Opcode ID: 1ac6e3ca3ef90700c1a63d797bcd86d3a2ecedb32e722ebbf51f8e06e9b44cab
Instruction ID: ba164521fbb39e679b403e1a679c7fedc73515b9c502e3ac353945dc1393c4ef
Opcode Fuzzy Hash: 1ac6e3ca3ef90700c1a63d797bcd86d3a2ecedb32e722ebbf51f8e06e9b44cab
Instruction Fuzzy Hash: B05103386023465EE7A8EF26EF45F563BD4AB10318F14007FF641862A2DBFC9944CA2D

Function 004CB3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004CB467

Part of subcall function 004CEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 004CEF92
Part of subcall function 004CEF7C: lstrlenA.KERNEL32(?), ref: 004CEF99
Part of subcall function 004CEF7C: lstrlenA.KERNEL32(00000000), ref: 004CEFA0

Strings

%FROM_EMAIL, xrefs: 004CB3E9
%FROM_USER, xrefs: 004CB431
%DATE, xrefs: 004CB4D2
%TO_DOMAIN, xrefs: 004CB44B
%TO_HASH, xrefs: 004CB4B0
%TO_EMAIL, xrefs: 004CB473
%P5DATE, xrefs: 004CB4F2
%s@%s, xrefs: 004CB461
%TO_USER, xrefs: 004CB488
%FROM_DOMAIN, xrefs: 004CB41E
%M5DATE, xrefs: 004CB50F

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 59d6dae464c533b0920b3faba5b1d4f2b4759ca39b3a802ff08a51f78f94d47f
Instruction ID: 66b3cf7a07a879b751b1d45317002a443ff44938c1de6ac487ae60b17979cc66
Opcode Fuzzy Hash: 59d6dae464c533b0920b3faba5b1d4f2b4759ca39b3a802ff08a51f78f94d47f
Instruction Fuzzy Hash: 46416DB65401187EDF00AAA6CCD2FBF7A6CEE0974CF14011FF904A2142DB78AA1487A9

Function 004CC2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004CA4C7: GetTickCount.KERNEL32 ref: 004CA4D1
Part of subcall function 004CA4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 004CA4FA

GetTickCount.KERNEL32 ref: 004CC31F
GetTickCount.KERNEL32 ref: 004CC32B
GetTickCount.KERNEL32 ref: 004CC363
GetTickCount.KERNEL32 ref: 004CC378
GetTickCount.KERNEL32 ref: 004CC44D
InterlockedIncrement.KERNEL32(004CC4E4), ref: 004CC4AE
CreateThread.KERNEL32(00000000,00000000,004CB535,00000000,?,004CC4E0), ref: 004CC4C1
CloseHandle.KERNEL32(00000000,?,004CC4E0,004D3588,004C8810), ref: 004CC4CC

Strings

localcfg, xrefs: 004CC2DD

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 24673712623286acfcbdf6ca0c5794be2d09371546d204ffa745a9d5bd90bd3f
Instruction ID: 0307270221df78aa65a2c8fa22fb47d3810731992ae33e9c9830369a8c6df973
Opcode Fuzzy Hash: 24673712623286acfcbdf6ca0c5794be2d09371546d204ffa745a9d5bd90bd3f
Instruction Fuzzy Hash: 15517FB5600B418FC7648F69D5D4A2ABBE9FB48304B50993FD58BC7AA0D778F840CB18

Function 004CBE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 004CBE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 004CBE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 004CBE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 004CBF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 004CBF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 004CBF94

Strings

smtp_ban, xrefs: 004CBE55, 004CBF77
smtp_retr, xrefs: 004CBE61, 004CBF8C
smtp_herr, xrefs: 004CBE46, 004CBF62

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5498af8048b6eeadd8e75fdbaea87334f49fa17848f6a3d483eccb3ab3e64249
Instruction ID: 375ae461effc23fe0266d8897300e21e5e063f1cc95cfdb0309cc60124e10e2c
Opcode Fuzzy Hash: 5498af8048b6eeadd8e75fdbaea87334f49fa17848f6a3d483eccb3ab3e64249
Instruction Fuzzy Hash: 7D51AF39A0021AAFDB518B65CC92FAA7BA9EF14344F14406FE841EB351D738ED418FD8

Function 004C6A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6A7D
GetDiskFreeSpaceA.KERNEL32(004C9E9D,004C9A60,?,?,?,004D22F8,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,004C9A60,?,?,004C9E9D), ref: 004C6B80
GetLastError.KERNEL32(?,?,?,004C9A60,?,?,004C9E9D,?,?,?,?,?,004C9E9D,?,00000022,?), ref: 004C6B96

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: a98b6ea87bc3c3d02a7a4096429a71d2d1d581941afd43a70c15bc6a92f9e690
Instruction ID: e785920719f576dfc817abc061515c7d7ebdd4431af0d9cc741c8f851401110c
Opcode Fuzzy Hash: a98b6ea87bc3c3d02a7a4096429a71d2d1d581941afd43a70c15bc6a92f9e690
Instruction Fuzzy Hash: AF31CCBA902149BFCB419FA09D44F9FBBB9EB48300F15807BE211E3211E734A9458F69

Function 004C6F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,004CD7C3), ref: 004C6F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,004CD7C3), ref: 004C6FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 004C6FE8
LocalFree.KERNEL32(00000120), ref: 004C701F
wsprintfA.USER32 ref: 004C7036

Strings

/%d, xrefs: 004C7030
|, xrefs: 004C6FB3

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 5a62fd4339008a46d58338b8b3f069d9a79bfb2481d357156310e134b7a7af95
Instruction ID: d01f510a59c8f45e097c839cb921dcd85adc8b2650f002ccb7acdd7ee33cbdf2
Opcode Fuzzy Hash: 5a62fd4339008a46d58338b8b3f069d9a79bfb2481d357156310e134b7a7af95
Instruction Fuzzy Hash: BE312B76500108BBDB41DFA5D845FDF7BA8AF04314F04806BF909DB201DA39DA088B98

Function 004C6CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004D22F8,000000E4,004C6DDC,000000C8), ref: 004C6CE7
GetProcAddress.KERNEL32(00000000), ref: 004C6CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 004C6D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 004C6D2B

Strings

kernel32, xrefs: 004C6CE2
C:\Windows\SysWOW64\, xrefs: 004C6CC9, 004C6CD1, 004C6CFE, 004C6D05, 004C6D13, 004C6D1E, 004C6D2A, 004C6D42, 004C6D5F, 004C6D85
GetSystemWow64DirectoryA, xrefs: 004C6CDD

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: f34a5e8cd58c80fc604d1d63b3fb1e925c67e6b4f3df8dd071588d31f63b270a
Instruction ID: 3c1e64b19c1349cd0c32d010e5e3644bd47baa15138df500ae4be634476dab03
Opcode Fuzzy Hash: f34a5e8cd58c80fc604d1d63b3fb1e925c67e6b4f3df8dd071588d31f63b270a
Instruction Fuzzy Hash: 4C21355974224039F7A257325E89F7B2F4C8B62744F0D809FF805A72D2CBDD884682AD

Function 004C977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,004C9947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004D22F8), ref: 004C97B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004D22F8), ref: 004C97EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004D22F8), ref: 004C97F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004D22F8), ref: 004C9831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004D22F8), ref: 004C984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,004D22F8), ref: 004C985B

Strings

D, xrefs: 004C97A9

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: f9dd04d3d9bba895192258002e4ea206a85955bff8225d0d483fcfea03a1b6b5
Instruction ID: 868e3742da55ae1e2ce7244975336ec824f35d3d402753958b4023b2093b80be
Opcode Fuzzy Hash: f9dd04d3d9bba895192258002e4ea206a85955bff8225d0d483fcfea03a1b6b5
Instruction Fuzzy Hash: FD216D75902129BBDB519FA1DC49FEF7BBCEF05750F400066B909E2150EB359A44CAA8

Function 004CE8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004CDD05: GetTickCount.KERNEL32 ref: 004CDD0F
Part of subcall function 004CDD05: InterlockedExchange.KERNEL32(004D36B4,00000001), ref: 004CDD44
Part of subcall function 004CDD05: GetCurrentThreadId.KERNEL32 ref: 004CDD53

Part of subcall function 004CDD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 004CDDB5

lstrcpynA.KERNEL32(?,004C1E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,004CEAAA,?,?), ref: 004CE8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,004CEAAA,?,?,00000001,?,004C1E84,?), ref: 004CE935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,004CEAAA,?,?,00000001,?,004C1E84,?,0000000A), ref: 004CE93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,004CEAAA,?,?,00000001,?,004C1E84,?), ref: 004CE94F

Strings

localcfg, xrefs: 004CE8AB
flags_upd, xrefs: 004CE8A7

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 0908d74fd094aae1d177ca834c77e48acc8e79906dfef2abc39900dec8f7a2d6
Instruction ID: bb547afcfde0830d9b25f30e6d4cb05e5d00098b0b24688b7fa71bdba7b654c8
Opcode Fuzzy Hash: 0908d74fd094aae1d177ca834c77e48acc8e79906dfef2abc39900dec8f7a2d6
Instruction Fuzzy Hash: DC515076D00209AFCB41EFA9C984EAEB7F9FF44308F14052EE405A3211DB79EA149B54

Function 004C6BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 004C6BB2

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 2fd00c2e03f3e75cd24c459dc7e542139a5314c5681fa91e36d8f5d7a1c43d8f
Instruction ID: 1a8869f5b927290ae55461d461d765f726292612f262ae8e2f6dfb17d58003ab
Opcode Fuzzy Hash: 2fd00c2e03f3e75cd24c459dc7e542139a5314c5681fa91e36d8f5d7a1c43d8f
Instruction Fuzzy Hash: 7C21A17A101115FFDB525B61FD49FAF3BACDB04364B21842BF502E2051EB38DA00967C

Function 004C9064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004D22F8), ref: 004C907B
wsprintfA.USER32 ref: 004C90E9
CreateFileA.KERNEL32(004D22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 004C910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 004C9122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 004C912D
CloseHandle.KERNEL32(00000000), ref: 004C9134

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 64c8c5a500366e8dc7622b98f4d76957bbfbf1ca69a40a5be735d5a62ab6586c
Instruction ID: 9e3e3016c07ae1bce3abf8e7130bfff429177fd496e2378394487b6620b8ccc7
Opcode Fuzzy Hash: 64c8c5a500366e8dc7622b98f4d76957bbfbf1ca69a40a5be735d5a62ab6586c
Instruction Fuzzy Hash: EF1184B66411147BF7656B23EC0EFAF366DDBC5B04F00807FBB0AA6191EA744E019668

Function 004CDD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004CDD0F
GetCurrentThreadId.KERNEL32 ref: 004CDD20
GetTickCount.KERNEL32 ref: 004CDD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,004CE538,?,75920F10,?,00000000,?,004CA445), ref: 004CDD3B
InterlockedExchange.KERNEL32(004D36B4,00000001), ref: 004CDD44
GetCurrentThreadId.KERNEL32 ref: 004CDD53

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: bc05a9d8b0d5ef1a396ad13fbaacd0a08f61bc1b80268cee19e9782d779e078d
Instruction ID: fafcfb2850569b7640972b914535e4d0e25ebde81a3780c7489f584e70542231
Opcode Fuzzy Hash: bc05a9d8b0d5ef1a396ad13fbaacd0a08f61bc1b80268cee19e9782d779e078d
Instruction Fuzzy Hash: 97F0BE76906204BBD7915F65BC84F293BA4E744312F00007BE20AC3260C7289545CE2F

Function 004CAD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 004CAD1C
lstrlenA.KERNEL32(00000000), ref: 004CAD60
lstrlenA.KERNEL32(00000000), ref: 004CAD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 004CAD7F

Strings

LocalHost, xrefs: 004CAD79

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 1b3f385fa85f30b4f5aaecae4eb5b84f49e297ac8b8deed8ceaf5b290ec28de6
Instruction ID: 719388dcd45ccf5874f294a38e04469f923d9ecf067f55b3889910d0af465ac9
Opcode Fuzzy Hash: 1b3f385fa85f30b4f5aaecae4eb5b84f49e297ac8b8deed8ceaf5b290ec28de6
Instruction Fuzzy Hash: BF01492C84418D5DDFB206289844FA63F779B9770EF10005FE4C2C7616D61C8853835F

Function 004C4280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004C98FD,00000001,00000100,004D22F8,004CA3C7), ref: 004C4290
CloseHandle.KERNEL32(004CA3C7), ref: 004C43AB
CloseHandle.KERNEL32(00000001), ref: 004C43AE

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: f0e4d0c38b3c2bdfffdbba55ef22ce55060f70a4e0bb16f71e74e709b1391079
Instruction ID: ff6964a2d6be4fa81cb16f4f8f8f257047f809d2014470a055174496efe34d94
Opcode Fuzzy Hash: f0e4d0c38b3c2bdfffdbba55ef22ce55060f70a4e0bb16f71e74e709b1391079
Instruction Fuzzy Hash: 02418375D00109BADB10AFA2CD46FEF7FB8EF80325F10455EF514A2191D7389A41DB64

Function 004C6069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004C64CF,00000000), ref: 004C609C
LoadLibraryA.KERNEL32(?,?,004C64CF,00000000), ref: 004C60C3
GetProcAddress.KERNEL32(?,00000014), ref: 004C614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 004C619E

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: a128973405898bae28d53bc5d0b19d2051d9e7f9025a27c2e81c5989a9474e4f
Instruction ID: e1d06ea70e973f5749cfa4e4386d6f8f31e1d9a6905ae892c542539093dc67fe
Opcode Fuzzy Hash: a128973405898bae28d53bc5d0b19d2051d9e7f9025a27c2e81c5989a9474e4f
Instruction Fuzzy Hash: D0418979A00106ABDB50CF59C880F6AB7B8EF04355F2AC06EE815D7391EB38ED41CB84

Function 004C2923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915389caf191f4b927dbb499c0a1a4a58cbdbcad14b903b848c3218b190806cb
Instruction ID: b7b9f3a2ddcaad29d53cf7e0cf2c803e65e96e41b2114025743b39d289a67857
Opcode Fuzzy Hash: 915389caf191f4b927dbb499c0a1a4a58cbdbcad14b903b848c3218b190806cb
Instruction Fuzzy Hash: FB31BF79A00619ABCB509FA6CD81BBEB7F4FF48705F10446FE504E7241E3B8DA418B68

Function 004C26FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C272E
htons.WS2_32(00000001), ref: 004C2752
htons.WS2_32(0000000F), ref: 004C27D5
htons.WS2_32(00000001), ref: 004C27E3
sendto.WS2_32(?,004D2BF8,00000009,00000000,00000010,00000010), ref: 004C2802

Part of subcall function 004CEBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,004CEBFE,7FFF0001,?,004CDB55,7FFF0001), ref: 004CEBD3
Part of subcall function 004CEBCC: RtlAllocateHeap.NTDLL(00000000,?,004CDB55,7FFF0001), ref: 004CEBDA

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 4815b5e8a4fc83553270df3f8c82d4be42b37ce66466dd1b51c4f8b62bc2ad43
Instruction ID: 47f37b8ba99dd51fb327272efef48c8fbce319c463e1ee92302f727ed2eae893
Opcode Fuzzy Hash: 4815b5e8a4fc83553270df3f8c82d4be42b37ce66466dd1b51c4f8b62bc2ad43
Instruction Fuzzy Hash: FB3104382823829FD7108F74D990E667760BF29318B19806FE8558B322D6F7E842D718

Function 004C9145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004D22F8), ref: 004C915F
GetModuleFileNameA.KERNEL32(00000000), ref: 004C9166
CharToOemA.USER32(?,?), ref: 004C9174
wsprintfA.USER32 ref: 004C91A9

Part of subcall function 004C9064: GetTempPathA.KERNEL32(00000400,?,00000000,004D22F8), ref: 004C907B
Part of subcall function 004C9064: wsprintfA.USER32 ref: 004C90E9
Part of subcall function 004C9064: CreateFileA.KERNEL32(004D22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 004C910E
Part of subcall function 004C9064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 004C9122
Part of subcall function 004C9064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 004C912D
Part of subcall function 004C9064: CloseHandle.KERNEL32(00000000), ref: 004C9134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004C91E1

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 61dd2dfb0d27c6cf5bfdcc0e8ed2b52b9fc8d5f41dec7d9f3c194100cf53e6a0
Instruction ID: bbda71737a33205aba49252010a3e06eceab56714e82e6d61c84ba5d34d4fd65
Opcode Fuzzy Hash: 61dd2dfb0d27c6cf5bfdcc0e8ed2b52b9fc8d5f41dec7d9f3c194100cf53e6a0
Instruction Fuzzy Hash: 890152FA9401187BD760A7629D4DFDF777CDB95B05F0000A7B749E2040DAB49A858F74

Function 004C2419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,004C2491,?,?,?,004CE844,-00000030,?,?,?,00000001), ref: 004C2429
lstrlenA.KERNEL32(?,?,004C2491,?,?,?,004CE844,-00000030,?,?,?,00000001,004C1E3D,00000001,localcfg,lid_file_upd), ref: 004C243E
lstrcmpiA.KERNEL32(?,?), ref: 004C2452
lstrlenA.KERNEL32(?,?,004C2491,?,?,?,004CE844,-00000030,?,?,?,00000001,004C1E3D,00000001,localcfg,lid_file_upd), ref: 004C2467

Strings

localcfg, xrefs: 004C241F

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: fdb7e888ffc0f2c163271c89e52a2f6db6ffeb1d1b4a651a09c81b7c5b2e48d9
Instruction ID: 02d82fdf9c30a396887b112e9b028dc421f46b1408ab3955e29f86bff0103575
Opcode Fuzzy Hash: fdb7e888ffc0f2c163271c89e52a2f6db6ffeb1d1b4a651a09c81b7c5b2e48d9
Instruction Fuzzy Hash: F3011A35600218BFCF55EF69DD80ADE7BA9EF44354B01C42AE85997210E3B4EA40CA98

Function 004C6EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 004C6F0F
CheckTokenMembership.ADVAPI32(00000000,?,*pL), ref: 004C6F24
FreeSid.ADVAPI32(?), ref: 004C6F3E

Strings

*pL, xrefs: 004C6F1C, 004C6F1F

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *pL
API String ID: 3429775523-2597219945
Opcode ID: a8eb5ac75762d3d4ee7ec6705a97b516a73bd85534136a7b194bc7f13267106c
Instruction ID: 2d6165f0756935f7d3e00eaf91cb47c33ddc6e682fbd10dc80b053c5d5a7d696
Opcode Fuzzy Hash: a8eb5ac75762d3d4ee7ec6705a97b516a73bd85534136a7b194bc7f13267106c
Instruction Fuzzy Hash: C8011E75901208BFDB11DFE4ED85FAE77B8EB04304F10887FE605E2151E7749944CA18

Function 004C1C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004C1CE1
wsprintfA.USER32 ref: 004C1D6B

Strings

localcfg, xrefs: 004C1C70
%u.%u.%u.%u.%s, xrefs: 004C1CDB, 004C1D65

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 7aa2cff6518119168288f3ed4639d535f9ed52aff59db381a5b01edf89d19578
Instruction ID: 84b5394328a2147331d24bc0815d11a2c9abd36bad3f2e07c29c5e4be4830962
Opcode Fuzzy Hash: 7aa2cff6518119168288f3ed4639d535f9ed52aff59db381a5b01edf89d19578
Instruction Fuzzy Hash: D241DF369002989FDB61CF798C44FEE3BE89F0A310F24005AFD60D3252D638EA04CBA4

Function 004CE654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004CDD05: GetTickCount.KERNEL32 ref: 004CDD0F
Part of subcall function 004CDD05: InterlockedExchange.KERNEL32(004D36B4,00000001), ref: 004CDD44
Part of subcall function 004CDD05: GetCurrentThreadId.KERNEL32 ref: 004CDD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,004C5EC1), ref: 004CE693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,004C5EC1), ref: 004CE6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,75920F10,00000000,?,004C5EC1), ref: 004CE722

Strings

89ABCDEF, xrefs: 004CE721

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: d3efcb5e32f33bcc5e0866d339d7c1cc3695e8c6d36f8e5d60e310e4b992dd45
Instruction ID: 7371dad12bb96de9a93684eb0878a53b2e465794217836d885e7b4e340719145
Opcode Fuzzy Hash: d3efcb5e32f33bcc5e0866d339d7c1cc3695e8c6d36f8e5d60e310e4b992dd45
Instruction Fuzzy Hash: 1A31EF39A11302DBCBB18F66D884F6B37E4AB20324F10843FE55687650E778EC80CB89

Function 004CE095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,004CE2A3,00000000,00000000,00000000,00020106,00000000,004CE2A3,00000000,000000E4), ref: 004CE0B2
RegSetValueExA.ADVAPI32(004CE2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004D22F8), ref: 004CE127
RegDeleteValueA.ADVAPI32(004CE2A3,?,?,?,?,?,000000C8,004D22F8), ref: 004CE158
RegCloseKey.ADVAPI32(004CE2A3,?,?,?,?,000000C8,004D22F8,?,?,?,?,?,?,?,?,004CE2A3), ref: 004CE161

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 646352c0c9f16613d89c48ceb7a7231b42a5116f7d3a4a47f93f18a21d0bcaa9
Instruction ID: c8971767fb2ac80ca570c2cc04d4c6e26a28a397b76bbd8867e9f4c2389cfb9f
Opcode Fuzzy Hash: 646352c0c9f16613d89c48ceb7a7231b42a5116f7d3a4a47f93f18a21d0bcaa9
Instruction Fuzzy Hash: B7219C31A00229BBDF619EA6DC89F9F7FB9EF08754F044066F904A2150EB718A14CB94

Function 004C3F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,004CA3C7,00000000,00000000,000007D0,00000001), ref: 004C3F44
GetLastError.KERNEL32 ref: 004C3F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 004C3F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 004C3F72

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 7a7d4cb4c2b78da3e2cad14a4442e24face8452b64840a07d6d72b2a5d288852
Instruction ID: fdc26bc39bfaa050d4059eb576baa465bec8c8854f790b0a682aa93603373568
Opcode Fuzzy Hash: 7a7d4cb4c2b78da3e2cad14a4442e24face8452b64840a07d6d72b2a5d288852
Instruction Fuzzy Hash: 4901E972912109ABDF01DF90ED44BEF7B7CEB04356F10842AFA01E2150D734DA158BBA

Function 004C3F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,004CA3C7,00000000,00000000,000007D0,00000001), ref: 004C3FB8
GetLastError.KERNEL32 ref: 004C3FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 004C3FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 004C3FE6

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 37c45f92fd704ab3fc4a43c7547d35be97bada8aaa74c108725e66dc2211e3a5
Instruction ID: afd497f02c37896304344ead73dce5717c4bf5cbf805c1f54f41b6d096187b43
Opcode Fuzzy Hash: 37c45f92fd704ab3fc4a43c7547d35be97bada8aaa74c108725e66dc2211e3a5
Instruction Fuzzy Hash: 2901297291110AABDF01DF94ED45BEF3BBCEB08356F00842AF902E2050D734DA148BBA

Function 004CA4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004CA4D1
GetTickCount.KERNEL32 ref: 004CA4E4
Sleep.KERNEL32(00000000,?,004CC2E9,004CC4E0,00000000,localcfg,?,004CC4E0,004D3588,004C8810), ref: 004CA4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 004CA4FA

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 0db20d39e1b77d56c2e2d9d4613632640ee4744cdf128cca5b8473f7a4df5c53
Instruction ID: cf3f0bd912c0a20699f70d5dedefc067b740095c997432aeccba6528d9992e7c
Opcode Fuzzy Hash: 0db20d39e1b77d56c2e2d9d4613632640ee4744cdf128cca5b8473f7a4df5c53
Instruction Fuzzy Hash: FBE0263B20220877C7001BA5BD84F6A7388AB4A761F054037FB04D3240C65AA85141BF

Function 004C4E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C4E9E
GetTickCount.KERNEL32 ref: 004C4EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 004C4EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 004C4EC3

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 359984679506c8b9bd00185a2f69d818ca4672a8c03de0e52069ed0232604487
Instruction ID: fe899e51c986c14b6a337e72d8100cd25e863c1add3c6f776be22d26ee618213
Opcode Fuzzy Hash: 359984679506c8b9bd00185a2f69d818ca4672a8c03de0e52069ed0232604487
Instruction Fuzzy Hash: 1AE0863A20221467D61027B9BE84F5A6799AB96361F060537E709D3180C65A984245B9

Function 004C4BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C4BDD
GetTickCount.KERNEL32 ref: 004C4BEC
Sleep.KERNEL32(00000000,?,?,?,02A1B114,004C50F2), ref: 004C4BF9
InterlockedExchange.KERNEL32(02A1B108,00000001), ref: 004C4C02

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 24c3059b018bc6c89f0506260fcf988047c5eced751e5673ee5a22bdbe4ddcd8
Instruction ID: 74c0b1106b67a8a95e34c2d611ca30b86a70f0da469873470ab45fb8748f94df
Opcode Fuzzy Hash: 24c3059b018bc6c89f0506260fcf988047c5eced751e5673ee5a22bdbe4ddcd8
Instruction Fuzzy Hash: 08E0863A24221467D75017A57E80F5A77989B96361F060077F708D3150D95AE84141B9

Function 004C30FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C3103
GetTickCount.KERNEL32 ref: 004C310F
Sleep.KERNEL32(00000000), ref: 004C311C
InterlockedExchange.KERNEL32(?,00000001), ref: 004C3128

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: e7d2dca63d41372aaf467d57ca0b581995c49d734370837b42f90053a575c2e0
Instruction ID: d4df164f5b3d0751408e536eb6e67bf0107015de6418ce1592e3efe539ac51f6
Opcode Fuzzy Hash: e7d2dca63d41372aaf467d57ca0b581995c49d734370837b42f90053a575c2e0
Instruction Fuzzy Hash: 9FE0C239201215BFDB406F75BE44F5A6B9ADF84762F05403BF201D31A0C9554D01897A

Function 004C6987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(004C9A60,?,?,00000000,00000000,004C9A60,?,00000000), ref: 004C69F9
WriteFile.KERNEL32(004C9A60,?,004C9A60,00000000,00000000), ref: 004C6A27

Strings

,kL, xrefs: 004C69A7, 004C69D5

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,kL
API String ID: 3934441357-930470209
Opcode ID: 4a67c524b8be7eda31fe68ce1e04b5a9f9dc7b886f165af050711f4b67bd9f18
Instruction ID: 1eaab636ce026711230c417406459cd0320d98ec8d0446c1d56b1ebb42c85878
Opcode Fuzzy Hash: 4a67c524b8be7eda31fe68ce1e04b5a9f9dc7b886f165af050711f4b67bd9f18
Instruction Fuzzy Hash: 6F313676A00209EFDB64CF69D984FAAB7F4EB04315F12846EE801E7200D375EE54CBA5

Function 004C8CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004C8D02
GetTickCount.KERNEL32 ref: 004C8DA1

Strings

localcfg, xrefs: 004C8D19

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 9a62ea1a0e63c7b18cc9a37d65d196c193d1fd21ef490ad41bc16e943ef0a8b5
Instruction ID: ebff12fdd3d3671089170fba5c940ccc2c349161b095f7f037a0f1aef549ea77
Opcode Fuzzy Hash: 9a62ea1a0e63c7b18cc9a37d65d196c193d1fd21ef490ad41bc16e943ef0a8b5
Instruction Fuzzy Hash: 4721C03A611215AFCB908F64DD85F9ABBB9EB21315B29006FD802D7291CF38E940C75A

Function 004CBFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004CBFD0
wsprintfA.USER32 ref: 004CC060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 004CC057

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 6d4175e935614c6513606c3b1149b6062c895b6f419c232884d724964a263483
Instruction ID: e1e08c355069369b10b68beb97e05226ce8fecbe86ca5c9c1a6733d483204003
Opcode Fuzzy Hash: 6d4175e935614c6513606c3b1149b6062c895b6f419c232884d724964a263483
Instruction Fuzzy Hash: B5119772100100FFDB429BA9DD44E567FA6FF88318B3481ADF6188E166D633D863EB50

Function 004C38F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004C30FA: GetTickCount.KERNEL32 ref: 004C3103
Part of subcall function 004C30FA: InterlockedExchange.KERNEL32(?,00000001), ref: 004C3128

GetCurrentThreadId.KERNEL32 ref: 004C3929
GetCurrentThreadId.KERNEL32 ref: 004C3939

Strings

%FROM_EMAIL, xrefs: 004C3913

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 6c6bc35a13817fedbc31e50f2360238e96e0ff1dc8d8b2c62a22c91371489de9
Instruction ID: fec4b45eeb4c2abd2d77d790885c7b1682ae6160d866a753373832113c761bf4
Opcode Fuzzy Hash: 6c6bc35a13817fedbc31e50f2360238e96e0ff1dc8d8b2c62a22c91371489de9
Instruction Fuzzy Hash: AF1104B9900214EBD760DF1AD581B69F3F4FB09716F10856FE84497291C7B8AA80CFA9

Function 004CAB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,004CBD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 004CABB9
InterlockedIncrement.KERNEL32(004D3640), ref: 004CABE1

Strings

%FROM_EMAIL, xrefs: 004CAB8C

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 8537b946b450c9db1de0ccd7afe2f1f6fd9eb928b6ee09c107edcc650c484ae3
Instruction ID: 51245cf27a3111cb429c8a0c49fa3e8c2bd7059e7d14b82d54964c0e9711931e
Opcode Fuzzy Hash: 8537b946b450c9db1de0ccd7afe2f1f6fd9eb928b6ee09c107edcc650c484ae3
Instruction Fuzzy Hash: 4D019E35508288AFDB21CF18D881F967BA6AF15318F14449AE6808B353C379EA55CB96

Function 004C26B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004C26C3
inet_ntoa.WS2_32(?), ref: 004C26E4

Strings

localcfg, xrefs: 004C26CD, 004C26D2, 004C26DE

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 0d2e0d28fb9510006f9952e94c7ec37c3dff983b682081276bd165da9e02934f
Instruction ID: 5e791386e0305f630fd5c8f216f1528c3f33e126128692a2cd480b98aa458bb2
Opcode Fuzzy Hash: 0d2e0d28fb9510006f9952e94c7ec37c3dff983b682081276bd165da9e02934f
Instruction Fuzzy Hash: 3BF082362492097BEF406FA5ED09F9A379CEB04350F10446FFA08CA090DBB5D94097AC

Function 004CEAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,004CEB54,_alldiv,004CF0B7,80000001,00000000,00989680,00000000,?,?,?,004CE342,00000000,7508EA50,80000001,00000000), ref: 004CEAF2
GetProcAddress.KERNEL32(76E80000,00000000), ref: 004CEB07

Strings

ntdll.dll, xrefs: 004CEAED

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 89b299af721506dc1f0d78a70672c4250cd5715899f5e76e98a22ec05fe61714
Instruction ID: 87e2e503f6f3d79facb94c37c6303aa03000d7657880c4d13eeea2ef5d8c6a2a
Opcode Fuzzy Hash: 89b299af721506dc1f0d78a70672c4250cd5715899f5e76e98a22ec05fe61714
Instruction Fuzzy Hash: 2BD0C978602702BB8F62DF65AD1AF1A77A8EB50702F40803BB416C2620E738E844DA0D

Function 004C2F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004C2D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,004C2F01,?,004C20FF,004D2000), ref: 004C2D3A
Part of subcall function 004C2D21: LoadLibraryA.KERNEL32(?), ref: 004C2D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004C2F73
HeapFree.KERNEL32(00000000), ref: 004C2F7A

Memory Dump Source

Source File: 00000013.00000002.3293035872.00000000004C0000.00000040.00000400.00020000.00000000.sdmp, Offset: 004C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4c0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: db36e5989226fe336c3157799c4d9089149d03af0495fa0a30321beea1d59dd9
Instruction ID: 90d3cf73005c3ba09812ea3a25123deed985ed59325a2a6925c4eaed2b346203
Opcode Fuzzy Hash: db36e5989226fe336c3157799c4d9089149d03af0495fa0a30321beea1d59dd9
Instruction Fuzzy Hash: BA51C27A90020A9FCF01DF64D884AFAB775FF16304F14416EEC96C7210E7769A19CB88

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bEsOrli29K.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\pwdgvjcm.exe

C:\Windows\SysWOW64\edgikboy\pwdgvjcm.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
bEsOrli29K.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre