Edit tour

Windows Analysis Report
ODy57hA4Su.exe

Overview

General Information

Sample name:	ODy57hA4Su.exe renamed because original name is a hash value
Original sample name:	8b9be712ba5f26a1f6369833d52193fb.exe
Analysis ID:	1505456
MD5:	8b9be712ba5f26a1f6369833d52193fb
SHA1:	187b0a0888114923e4f611ed90402d7bf0e21733
SHA256:	6b880d602f77fc4061a3f6b0a7619e9a8899d9e61eeeea4460eec1d900aeb66f
Tags:	exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Query firmware table information (likely to detect VMs)

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Modifies existing windows services

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

svchost.exe (PID: 7772 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7780 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7916 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 7008 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 3944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7924 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ODy57hA4Su.exe (PID: 8096 cmdline: "C:\Users\user\Desktop\ODy57hA4Su.exe" MD5: 8B9BE712BA5F26A1F6369833D52193FB)

cmd.exe (PID: 7348 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\puwycifc\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7528 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\jhrsuqtz.exe" C:\Windows\SysWOW64\puwycifc\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2088 cmdline: "C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 6208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3536 cmdline: "C:\Windows\System32\sc.exe" description puwycifc "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 4196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6668 cmdline: "C:\Windows\System32\sc.exe" start puwycifc MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 5860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6796 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 5808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

jhrsuqtz.exe (PID: 1244 cmdline: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d"C:\Users\user\Desktop\ODy57hA4Su.exe" MD5: F5B76C95C1D9FC0EC3E2E435EB8464A0)

svchost.exe (PID: 8172 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000010.00000002.1401015750.0000000000733000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1250:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000004.00000002.1359133797.0000000000529000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1488:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: ODy57hA4Su.exe PID: 8096	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: jhrsuqtz.exe PID: 1244	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 8172	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.ODy57hA4Su.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
4.2.ODy57hA4Su.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.2.ODy57hA4Su.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.2.jhrsuqtz.exe.700000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.jhrsuqtz.exe.700000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.jhrsuqtz.exe.700000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
4.3.ODy57hA4Su.exe.2080000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.3.ODy57hA4Su.exe.2080000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
16.2.jhrsuqtz.exe.5b0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.jhrsuqtz.exe.5b0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
4.2.ODy57hA4Su.exe.4f0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
4.2.ODy57hA4Su.exe.4f0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.2.ODy57hA4Su.exe.4f0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.3.jhrsuqtz.exe.5d0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.3.jhrsuqtz.exe.5d0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
4.2.ODy57hA4Su.exe.4f0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.2.ODy57hA4Su.exe.4f0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
16.2.jhrsuqtz.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.jhrsuqtz.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.jhrsuqtz.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.3.jhrsuqtz.exe.5d0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.3.jhrsuqtz.exe.5d0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.3.jhrsuqtz.exe.5d0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
4.2.ODy57hA4Su.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
4.2.ODy57hA4Su.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.2.ODy57hA4Su.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
19.2.svchost.exe.2ed0000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
19.2.svchost.exe.2ed0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
19.2.svchost.exe.2ed0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.2.jhrsuqtz.exe.5b0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.jhrsuqtz.exe.5b0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.jhrsuqtz.exe.5b0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
4.3.ODy57hA4Su.exe.2080000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
4.3.ODy57hA4Su.exe.2080000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.3.ODy57hA4Su.exe.2080000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.2.jhrsuqtz.exe.700000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.jhrsuqtz.exe.700000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.jhrsuqtz.exe.700000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
19.2.svchost.exe.2ed0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
19.2.svchost.exe.2ed0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
19.2.svchost.exe.2ed0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.2.jhrsuqtz.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.jhrsuqtz.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.jhrsuqtz.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d"C:\Users\user\Desktop\ODy57hA4Su.exe", ParentImage: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, ParentProcessId: 1244, ParentProcessName: jhrsuqtz.exe, ProcessCommandLine: svchost.exe, ProcessId: 8172, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\ODy57hA4Su.exe", ParentImage: C:\Users\user\Desktop\ODy57hA4Su.exe, ParentProcessId: 8096, ParentProcessName: ODy57hA4Su.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2088, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.11.0, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 8172, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d"C:\Users\user\Desktop\ODy57hA4Su.exe", ParentImage: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, ParentProcessId: 1244, ParentProcessName: jhrsuqtz.exe, ProcessCommandLine: svchost.exe, ProcessId: 8172, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 8172, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\puwycifc

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\ODy57hA4Su.exe", ParentImage: C:\Users\user\Desktop\ODy57hA4Su.exe, ParentProcessId: 8096, ParentProcessName: ODy57hA4Su.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2088, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, ProcessId: 7772, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: vanaheim.cn:443	Avira URL Cloud: Label: phishing
Source: jotunheim.name:443	Avira URL Cloud: Label: malware

Found malware configuration

Source: 16.3.jhrsuqtz.exe.5d0000.0.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for domain / URL

Source: vanaheim.cn	Virustotal: Detection: 15%	Perma Link
Source: vanaheim.cn:443	Virustotal: Detection: 7%	Perma Link
Source: jotunheim.name:443	Virustotal: Detection: 12%	Perma Link

Multi AV Scanner detection for submitted file

Source: ODy57hA4Su.exe	ReversingLabs: Detection: 67%
Source: ODy57hA4Su.exe	Virustotal: Detection: 46%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\jhrsuqtz.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ODy57hA4Su.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Unpacked PE file: 4.2.ODy57hA4Su.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Unpacked PE file: 16.2.jhrsuqtz.exe.400000.0.unpack

Source: ODy57hA4Su.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\puwycifc

Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.11.0 52.101.11.0
Source: Joe Sandbox View	IP Address: 67.195.228.109 67.195.228.109
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150
Source: Joe Sandbox View	IP Address: 77.232.41.29 77.232.41.29

Source: Joe Sandbox View

ASN Name: EUT-ASEUTIPNetworkRU EUT-ASEUTIPNetworkRU

Source: global traffic	TCP traffic: 192.168.2.10:49705 -> 52.101.11.0:25
Source: global traffic	TCP traffic: 192.168.2.10:65451 -> 67.195.228.109:25
Source: global traffic	TCP traffic: 192.168.2.10:65452 -> 142.251.168.27:25
Source: global traffic	TCP traffic: 192.168.2.10:65455 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

4_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: svchost.exe, 00000003.00000002.2529599067.00000202C3D18000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.2529400595.00000202C3496000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.3.dr

String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65453

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 4.2.ODy57hA4Su.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.700000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ODy57hA4Su.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.jhrsuqtz.exe.5d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ODy57hA4Su.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2ed0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.5b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.ODy57hA4Su.exe.2080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.700000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2ed0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ODy57hA4Su.exe PID: 8096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jhrsuqtz.exe PID: 1244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8172, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.ODy57hA4Su.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.2.ODy57hA4Su.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.jhrsuqtz.exe.700000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.jhrsuqtz.exe.700000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 4.3.ODy57hA4Su.exe.2080000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.3.ODy57hA4Su.exe.2080000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.jhrsuqtz.exe.5b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.jhrsuqtz.exe.5b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 4.2.ODy57hA4Su.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.2.ODy57hA4Su.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.3.jhrsuqtz.exe.5d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.3.jhrsuqtz.exe.5d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 4.2.ODy57hA4Su.exe.4f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.2.ODy57hA4Su.exe.4f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.jhrsuqtz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.jhrsuqtz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.3.jhrsuqtz.exe.5d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.3.jhrsuqtz.exe.5d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 4.2.ODy57hA4Su.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.2.ODy57hA4Su.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 19.2.svchost.exe.2ed0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 19.2.svchost.exe.2ed0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.jhrsuqtz.exe.5b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.jhrsuqtz.exe.5b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 4.3.ODy57hA4Su.exe.2080000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.3.ODy57hA4Su.exe.2080000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.jhrsuqtz.exe.700000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.jhrsuqtz.exe.700000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 19.2.svchost.exe.2ed0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 19.2.svchost.exe.2ed0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.jhrsuqtz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.jhrsuqtz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000010.00000002.1401015750.0000000000733000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000004.00000002.1359133797.0000000000529000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

4_2_00408E26

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

4_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\puwycifc\

Jump to behavior

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: 4_2_0040C913	4_2_0040C913
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: 4_2_0041A630	4_2_0041A630
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_0040C913	16_2_0040C913
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_0041A630	16_2_0041A630
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00733260	16_2_00733260
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00733648	16_2_00733648
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_0073344F	16_2_0073344F
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00733838	16_2_00733838
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_007332C0	16_2_007332C0
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_007334B8	16_2_007334B8
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_007338A0	16_2_007338A0
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_007336A9	16_2_007336A9
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00733770	16_2_00733770
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00733328	16_2_00733328
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00733710	16_2_00733710
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00733517	16_2_00733517
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00733901	16_2_00733901
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_007333F0	16_2_007333F0
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_007331F6	16_2_007331F6
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_007337D8	16_2_007337D8
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_007335DF	16_2_007335DF
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00733580	16_2_00733580
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00733388	16_2_00733388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_02EDC913	19_2_02EDC913

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: String function: 004F27AB appears 35 times

Source: ODy57hA4Su.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.ODy57hA4Su.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.2.ODy57hA4Su.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.jhrsuqtz.exe.700000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.jhrsuqtz.exe.700000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 4.3.ODy57hA4Su.exe.2080000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.3.ODy57hA4Su.exe.2080000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.jhrsuqtz.exe.5b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.jhrsuqtz.exe.5b0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 4.2.ODy57hA4Su.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.2.ODy57hA4Su.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.3.jhrsuqtz.exe.5d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.3.jhrsuqtz.exe.5d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 4.2.ODy57hA4Su.exe.4f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.2.ODy57hA4Su.exe.4f0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.jhrsuqtz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.jhrsuqtz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.3.jhrsuqtz.exe.5d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.3.jhrsuqtz.exe.5d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 4.2.ODy57hA4Su.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.2.ODy57hA4Su.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 19.2.svchost.exe.2ed0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 19.2.svchost.exe.2ed0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.jhrsuqtz.exe.5b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.jhrsuqtz.exe.5b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 4.3.ODy57hA4Su.exe.2080000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.3.ODy57hA4Su.exe.2080000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.jhrsuqtz.exe.700000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.jhrsuqtz.exe.700000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 19.2.svchost.exe.2ed0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 19.2.svchost.exe.2ed0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.jhrsuqtz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.jhrsuqtz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000010.00000002.1401015750.0000000000733000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000004.00000002.1359133797.0000000000529000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: ODy57hA4Su.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@29/5@9/5

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

4_2_00406A60

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_0052A4B6 CreateToolhelp32Snapshot,Module32First,

4_2_0052A4B6

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

4_2_00409A6B

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: 4_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	4_2_00409A6B
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	16_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_02ED9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	19_2_02ED9A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7376:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4196:120:WilError_03

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

File created: C:\Users\user\AppData\Local\Temp\jhrsuqtz.exe

Jump to behavior

Source: ODy57hA4Su.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ODy57hA4Su.exe	ReversingLabs: Detection: 67%
Source: ODy57hA4Su.exe	Virustotal: Detection: 46%

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

File read: C:\Users\user\Desktop\ODy57hA4Su.exe

Jump to behavior

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_4-14997
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_16-15951

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Users\user\Desktop\ODy57hA4Su.exe "C:\Users\user\Desktop\ODy57hA4Su.exe"
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\puwycifc\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\jhrsuqtz.exe" C:\Windows\SysWOW64\puwycifc\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description puwycifc "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start puwycifc
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d"C:\Users\user\Desktop\ODy57hA4Su.exe"
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\puwycifc\	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\jhrsuqtz.exe" C:\Windows\SysWOW64\puwycifc\	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description puwycifc "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start puwycifc	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsusererclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Unpacked PE file: 4.2.ODy57hA4Su.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Unpacked PE file: 16.2.jhrsuqtz.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Unpacked PE file: 4.2.ODy57hA4Su.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Unpacked PE file: 16.2.jhrsuqtz.exe.400000.0.unpack

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_00406069

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: 4_2_0052D79E push 0000002Bh; iretd		4_2_0052D7A4
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00737566 push 0000002Bh; iretd		16_2_0073756C

Source: ODy57hA4Su.exe

Static PE information: section name: .text entropy: 7.4121914169616785

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	File created: C:\Users\user\AppData\Local\Temp\jhrsuqtz.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\puwycifc

Jump to behavior

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

4_2_00409A6B

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\ody57ha4su.exe

Jump to behavior

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_00401000

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

19_2_02ED199C

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_4-16089
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_16-17285
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_19-7606

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_19-6142

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_4-15439
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_19-7325
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_16-16336

Source: C:\Windows\SysWOW64\svchost.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_19-7443

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_4-15012
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_16-15968

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	API coverage: 6.4 %
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	API coverage: 5.0 %

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: 4_2_0041A630 GetSystemTimes followed by cmp: cmp dword ptr [00421ffch], 0ah and CTI: jne 0041A887h		4_2_0041A630
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_0041A630 GetSystemTimes followed by cmp: cmp dword ptr [00421ffch], 0ah and CTI: jne 0041A887h		16_2_0041A630

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

4_2_00401D96

Source: svchost.exe, 00000001.00000002.2529772280.0000015D20254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D: @
Source: svchost.exe, 00000001.00000002.2529919906.0000015D2027E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000001.00000002.2529575225.0000015D2022B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000001.00000002.2529772280.0000015D20254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000es
Source: svchost.exe, 00000001.00000002.2529575225.0000015D20239000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}esD
Source: svchost.exe, 00000001.00000002.2529393924.0000015D20202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000001.00000002.2530028168.0000015D20302000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000001.00000002.2529772280.0000015D20254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000013.00000002.2529242568.0000000003200000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_19-7636
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_16-17315
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_4-16470

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_00406069

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: 4_2_004F092B mov eax, dword ptr fs:[00000030h]	4_2_004F092B
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: 4_2_004F0D90 mov eax, dword ptr fs:[00000030h]	4_2_004F0D90
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: 4_2_00529D93 push dword ptr fs:[00000030h]	4_2_00529D93
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_005B092B mov eax, dword ptr fs:[00000030h]	16_2_005B092B
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_005B0D90 mov eax, dword ptr fs:[00000030h]	16_2_005B0D90
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00733B5B push dword ptr fs:[00000030h]	16_2_00733B5B

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

4_2_0040EBCC

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: 4_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	4_2_00409A6B
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	16_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_02ED9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	19_2_02ED9A6B

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2ED0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2ED0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2ED0000			Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2D4C008			Jump to behavior

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\puwycifc\	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\jhrsuqtz.exe" C:\Windows\SysWOW64\puwycifc\	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description puwycifc "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start puwycifc	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

4_2_00407809

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

4_2_00406EDD

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

4_2_0040405E

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

4_2_0040EC54

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

4_2_00407809

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

4_2_0040B211

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Code function: 4_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

4_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\ODy57hA4Su.exe

Source: svchost.exe, 00000002.00000002.2529932039.000002064CD02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000002.00000002.2529932039.000002064CD02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 4.2.ODy57hA4Su.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.700000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ODy57hA4Su.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.jhrsuqtz.exe.5d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ODy57hA4Su.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2ed0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.5b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.ODy57hA4Su.exe.2080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.700000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2ed0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ODy57hA4Su.exe PID: 8096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jhrsuqtz.exe PID: 1244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8172, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 4.2.ODy57hA4Su.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.700000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ODy57hA4Su.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.jhrsuqtz.exe.5d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ODy57hA4Su.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2ed0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.5b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.ODy57hA4Su.exe.2080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.700000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.svchost.exe.2ed0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jhrsuqtz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ODy57hA4Su.exe PID: 8096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jhrsuqtz.exe PID: 1244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8172, type: MEMORYSTR

Source: C:\Users\user\Desktop\ODy57hA4Su.exe	Code function: 4_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	4_2_004088B0
Source: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe	Code function: 16_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	16_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 19_2_02ED88B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	19_2_02ED88B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	4 Disable or Modify Tools	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	41 Native API	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	14 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 Service Execution	Login Hook	14 Windows Service	22 Software Packing	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	312 Process Injection	1 DLL Side-Loading	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	22 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	312 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ODy57hA4Su.exe	68%	ReversingLabs	Win32.Trojan.GCleaner
ODy57hA4Su.exe	47%	Virustotal		Browse
ODy57hA4Su.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\jhrsuqtz.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
mxs.mail.ru	0%	Virustotal	Browse
mta5.am0.yahoodns.net	0%	Virustotal	Browse
microsoft-com.mail.protection.outlook.com	0%	Virustotal	Browse
vanaheim.cn	16%	Virustotal	Browse
smtp.google.com	0%	Virustotal	Browse
yahoo.com	0%	Virustotal	Browse
mail.ru	0%	Virustotal	Browse
google.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	0%	URL Reputation	safe
vanaheim.cn:443	100%	Avira URL Cloud	phishing
jotunheim.name:443	100%	Avira URL Cloud	malware
vanaheim.cn:443	8%	Virustotal		Browse
jotunheim.name:443	13%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mxs.mail.ru	217.69.139.150	true	false	0%, Virustotal, Browse	unknown
mta5.am0.yahoodns.net	67.195.228.109	true	false	0%, Virustotal, Browse	unknown
microsoft-com.mail.protection.outlook.com	52.101.11.0	true	false	0%, Virustotal, Browse	unknown
vanaheim.cn	77.232.41.29	true	true	16%, Virustotal, Browse	unknown
smtp.google.com	142.251.168.27	true	false	0%, Virustotal, Browse	unknown
google.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
yahoo.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
mail.ru	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	8%, Virustotal, Browse Avira URL Cloud: phishing	unknown
jotunheim.name:443	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	svchost.exe, 00000003.00000002.2529599067.00000202C3D18000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.2529400595.00000202C3496000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.3.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.101.11.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
67.195.228.109	mta5.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	false
142.251.168.27	smtp.google.com	United States	15169	GOOGLEUS	false
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	false
77.232.41.29	vanaheim.cn	Russian Federation	28968	EUT-ASEUTIPNetworkRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1505456
Start date and time:	2024-09-06 09:46:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ODy57hA4Su.exe renamed because original name is a hash value
Original Sample Name:	8b9be712ba5f26a1f6369833d52193fb.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@29/5@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 70 Number of non-executed functions: 261
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.70.246.20, 20.112.250.133, 20.76.201.171, 20.231.239.246, 20.236.44.162
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:48:08	API Interceptor	2x Sleep call for process: svchost.exe modified
03:48:12	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.11.0	knkduwqg.exe	Get hash	malicious	Tofsee	Browse
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
67.195.228.109	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	document_excel.exe	Get hash	malicious	Unknown	Browse
	data.log.exe	Get hash	malicious	Unknown	Browse
217.69.139.150	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse
	foufdsk.exe	Get hash	malicious	Tofsee	Browse
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
77.232.41.29	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse
	vekvtia.exe	Get hash	malicious	Tofsee	Browse
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse
	foufdsk.exe	Get hash	malicious	Tofsee	Browse
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
microsoft-com.mail.protection.outlook.com	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
mta5.am0.yahoodns.net	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	67.195.204.72
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.74
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.77
	newtpp.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.77
vanaheim.cn	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	213.226.112.95
mxs.mail.ru	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
YAHOO-GQ1US	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	67.195.2.108
	154.213.187.80-x86-2024-09-01T00_09_56.elf	Get hash	malicious	Mirai	Browse	98.137.238.184
	teste.x86.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	98.137.238.174
	https://ashanioliver14.wixsite.com/my-site-1	Get hash	malicious	Unknown	Browse	67.195.160.105
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	67.195.228.106
	.exe	Get hash	malicious	Unknown	Browse	67.195.228.84
MAILRU-ASMailRuRU	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	tjigfd64.exe	Get hash	malicious	LummaC Stealer	Browse	5.181.61.0
	tjigfd64.exe	Get hash	malicious	LummaC Stealer	Browse	5.181.61.0
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	http://manga-netflix10737.tinyblogging.com.xx3.kz/	Get hash	malicious	Unknown	Browse	94.100.180.209
MICROSOFT-CORP-MSN-AS-BLOCKUS	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	file.exe	Get hash	malicious	Unknown	Browse	13.107.253.72
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse	52.111.243.31
	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	20.75.60.91
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.51
EUT-ASEUTIPNetworkRU	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	Set-up.exe	Get hash	malicious	Cryptbot	Browse	77.232.42.234
	Set-up.exe	Get hash	malicious	Cryptbot	Browse	77.232.42.234
	file.exe	Get hash	malicious	Cryptbot	Browse	77.232.42.234

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966299883488245
Encrypted:	false
SSDEEP:	24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
MD5:	24567B9212F806F6E3E27CDEB07728C0
SHA1:	371AE77042FFF52327BF4B929495D5603404107D
SHA-256:	82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
SHA-512:	5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

C:\Users\user\AppData\Local\Temp\jhrsuqtz.exe

Download File

Process:	C:\Users\user\Desktop\ODy57hA4Su.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10770432
Entropy (8bit):	5.558530187858237
Encrypted:	false
SSDEEP:	196608:snEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEQ:s
MD5:	F5B76C95C1D9FC0EC3E2E435EB8464A0
SHA1:	06336B251E7666FE9C624C63D9BA86791F3C6DAB
SHA-256:	F5790AC483240F6D0D98FCB58CEB7ECC48FD8A973E14AE642117346E410308E7
SHA-512:	E7C612535903A8354C52F2CDD90FEA29F34E5580C5236387495B636D88BF19471E5EADBC442F29C2795430360B0318F4B861BF1F60B19EA7AE7D5C679ADA0807
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.w.....................\|.......\|.......\|...u...............}...\|.......\|.......\|.......Rich............PE..L.....Le..........................................@.............................................................................<....P..pn...........................................................................................................text............................... ..`.rdata...&.......(..................@..@.data...`a....... ..................@....rsrc...pn...P...p..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.2447141402027047
Encrypted:	false
SSDEEP:	48:FaqdF7w8l0+AAHdKoqKFxcxkF28lraqdF7XM+AAHdKoqKFxcxkFNS:cEG+AAsoJjykcEXM+AAsoJjyknS
MD5:	03849BCB19E53DF7423BF6F52DEA6161
SHA1:	65282542A457FC2656A91139DC0F5342B4F95A36
SHA-256:	1EEBFDD67DF2D1EBB98834FD1BA8393C42B34FF25353B00D029E23674AAFC9C8
SHA-512:	59AB3038A7971AA52C0545A2049BF98FE3377CE0EFEF8F68270F6EABE77D6B4BE25E022C38CCD8F2D8EA88E40D12BCA99983C705EE1E8DF1E59D91B3EF551E9F
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. O.c.t. .. 0.5. .. 2.0.2.3. .1.2.:.2.8.:.3.6.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10770432
Entropy (8bit):	5.558530187858237
Encrypted:	false
SSDEEP:	196608:snEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEQ:s
MD5:	F5B76C95C1D9FC0EC3E2E435EB8464A0
SHA1:	06336B251E7666FE9C624C63D9BA86791F3C6DAB
SHA-256:	F5790AC483240F6D0D98FCB58CEB7ECC48FD8A973E14AE642117346E410308E7
SHA-512:	E7C612535903A8354C52F2CDD90FEA29F34E5580C5236387495B636D88BF19471E5EADBC442F29C2795430360B0318F4B861BF1F60B19EA7AE7D5C679ADA0807
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.w.....................\|.......\|.......\|...u...............}...\|.......\|.......\|.......Rich............PE..L.....Le..........................................@.............................................................................<....P..pn...........................................................................................................text............................... ..`.rdata...&.......(..................@..@.data...`a....... ..................@....rsrc...pn...P...p..................@..@........................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.567658781259732
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ODy57hA4Su.exe
File size:	219'136 bytes
MD5:	8b9be712ba5f26a1f6369833d52193fb
SHA1:	187b0a0888114923e4f611ed90402d7bf0e21733
SHA256:	6b880d602f77fc4061a3f6b0a7619e9a8899d9e61eeeea4460eec1d900aeb66f
SHA512:	33c457fab7b2910452de37d2a263d46b2391bb4b34b0c37793b6f5875180e92cb2caebfb2ab08e72393b0230407505c94eef6b41040c1500b2b4393fb3b58d08
SSDEEP:	3072:YASCGfSRnbJBJ0IQALHFv0raVXyPg9a+lfB0pyTbQ:0fSRnbJBJTLlr04C6
TLSH:	C3246B7032A19036EDA74F308570CA940D3BBCA2AA75818E3675F75E9F737D26B51312
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.w.....................\|.......\|.......\|...u...............}...\|.......\|.......\|.......Rich............PE..L.....Le...........

File Icon


Icon Hash:	73873bb18b9383ec

Static PE Info

General

Entrypoint:	0x401abc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x654C961B [Thu Nov 9 08:19:39 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	68652b48a737e9f2c13434df562b207d

Entrypoint Preview

Instruction
call 00007FDAF89B0A61h
jmp 00007FDAF89AC3FEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0041FB10h], eax
mov dword ptr [0041FB0Ch], ecx
mov dword ptr [0041FB08h], edx
mov dword ptr [0041FB04h], ebx
mov dword ptr [0041FB00h], esi
mov dword ptr [0041FAFCh], edi
mov word ptr [0041FB28h], ss
mov word ptr [0041FB1Ch], cs
mov word ptr [0041FAF8h], ds
mov word ptr [0041FAF4h], es
mov word ptr [0041FAF0h], fs
mov word ptr [0041FAECh], gs
pushfd
pop dword ptr [0041FB20h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0041FB14h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0041FB18h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0041FB24h], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0041FA60h], 00010001h
mov eax, dword ptr [0041FB18h]
mov dword ptr [0041FA14h], eax
mov dword ptr [0041FA08h], C0000409h
mov dword ptr [0041FA0Ch], 00000001h
mov eax, dword ptr [0041E004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0041E008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000D8h]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1cdb4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0x16e70	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19a1f	0x19c00	bd40c9b4ab5d8dd51699ee5e0fe9bfab	False	0.7730108464805825	data	7.4121914169616785	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x26bc	0x2800	1f20ea55c45480c2aaa811c1622e7519	False	0.33779296875	data	4.901974891539308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1e000	0x6160	0x2000	5522bd5cdd4c15915bebcb351be22c7e	False	0.1864013671875	data	2.1351772058530196	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25000	0x16e70	0x17000	fdbdc2b5205391f6c3bf96a469d1e710	False	0.4806067425271739	data	5.530443203556076	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x36bd8	0x2	data			5.0
LEBELIKOYALIPIDEKOMAKISIHU	0x35bb8	0xbf7	ASCII text, with very long lines (3063), with no line terminators	Turkish	Turkey	0.6010447273914463
VORAPABONADIDOS	0x367b0	0x3fa	ASCII text, with very long lines (1018), with no line terminators	Turkish	Turkey	0.630648330058939
RT_CURSOR	0x36be0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.7368421052631579
RT_CURSOR	0x36d10	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.06130705394190871
RT_ICON	0x25980	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.582089552238806
RT_ICON	0x26828	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6588447653429603
RT_ICON	0x270d0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.7246543778801844
RT_ICON	0x27798	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.7666184971098265
RT_ICON	0x27d00	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.5450207468879668
RT_ICON	0x2a2a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.6613508442776735
RT_ICON	0x2b350	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.684016393442623
RT_ICON	0x2bcd8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.8058510638297872
RT_ICON	0x2c1b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.35287846481876334
RT_ICON	0x2d060	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5518953068592057
RT_ICON	0x2d908	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6209677419354839
RT_ICON	0x2dfd0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6791907514450867
RT_ICON	0x2e538	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.42738589211618255
RT_ICON	0x30ae0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.5209016393442623
RT_ICON	0x31468	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.5070921985815603
RT_ICON	0x31938	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.4064498933901919
RT_ICON	0x327e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5640794223826715
RT_ICON	0x33088	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6273041474654378
RT_ICON	0x33750	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6351156069364162
RT_ICON	0x33cb8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.4643527204502814
RT_ICON	0x34d60	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.4504098360655738
RT_ICON	0x356e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.5
RT_DIALOG	0x39488	0x84	data			0.7651515151515151
RT_STRING	0x39510	0x3c2	data			0.46153846153846156
RT_STRING	0x398d8	0x638	data			0.43467336683417085
RT_STRING	0x39f10	0x46	data			0.6714285714285714
RT_STRING	0x39f58	0x8b6	data			0.41524663677130047
RT_STRING	0x3a810	0x64e	data			0.43246592317224286
RT_STRING	0x3ae60	0x782	data			0.42351716961498437
RT_STRING	0x3b5e8	0x728	data			0.42740174672489084
RT_STRING	0x3bd10	0x15a	data			0.5086705202312138
RT_ACCELERATOR	0x36bb0	0x28	data			1.025
RT_GROUP_CURSOR	0x392b8	0x22	data			1.088235294117647
RT_GROUP_ICON	0x318d0	0x68	data	Turkish	Turkey	0.7019230769230769
RT_GROUP_ICON	0x2c140	0x76	data	Turkish	Turkey	0.6610169491525424
RT_GROUP_ICON	0x35b50	0x68	data	Turkish	Turkey	0.7211538461538461
RT_VERSION	0x392e0	0x1a8	data			0.589622641509434

Imports

DLL

Import

KERNEL32.dll

FillConsoleOutputCharacterA, GetNumaProcessorNode, DebugActiveProcessStop, GetDefaultCommConfigW, CallNamedPipeA, WriteConsoleOutputW, HeapAlloc, GlobalSize, GetEnvironmentStringsW, CreateDirectoryW, GetComputerNameW, GetSystemDefaultLCID, GetModuleHandleW, GetConsoleAliasesLengthA, GetCommandLineA, GetSystemTimes, GlobalAlloc, LoadLibraryW, GetConsoleAliasExesLengthW, SetConsoleMode, GetFileAttributesW, SetConsoleTitleA, GetShortPathNameA, InterlockedExchange, GetStartupInfoA, GetLastError, GetProcAddress, SetStdHandle, EnterCriticalSection, SearchPathA, BuildCommDCBW, GetNumaHighestNodeNumber, LoadLibraryA, UnhandledExceptionFilter, InterlockedExchangeAdd, WritePrivateProfileStringA, QueryDosDeviceW, VirtualLock, FoldStringW, GetModuleFileNameA, FreeEnvironmentStringsW, FindAtomW, CopyFileExA, WriteConsoleW, CloseHandle, MultiByteToWideChar, EncodePointer, DecodePointer, ExitProcess, HeapSetInformation, GetStartupInfoW, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, IsDebuggerPresent, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, WriteFile, GetStdHandle, GetModuleFileNameW, HeapCreate, LeaveCriticalSection, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, Sleep, HeapSize, WideCharToMultiByte, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringW, GetStringTypeW, HeapFree, RtlUnwind, ReadFile, HeapReAlloc, IsProcessorFeaturePresent, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, CreateFileW

USER32.dll

GetUserObjectInformationW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 6, 2024 09:47:25.890877008 CEST	49705	25	192.168.2.10	52.101.11.0
Sep 6, 2024 09:47:26.897068024 CEST	49705	25	192.168.2.10	52.101.11.0
Sep 6, 2024 09:47:28.912662029 CEST	49705	25	192.168.2.10	52.101.11.0
Sep 6, 2024 09:47:29.038562059 CEST	49706	443	192.168.2.10	77.232.41.29
Sep 6, 2024 09:47:29.038590908 CEST	443	49706	77.232.41.29	192.168.2.10
Sep 6, 2024 09:47:29.038670063 CEST	49706	443	192.168.2.10	77.232.41.29
Sep 6, 2024 09:47:32.912616968 CEST	49705	25	192.168.2.10	52.101.11.0
Sep 6, 2024 09:47:40.912640095 CEST	49705	25	192.168.2.10	52.101.11.0
Sep 6, 2024 09:47:45.898736954 CEST	65451	25	192.168.2.10	67.195.228.109
Sep 6, 2024 09:47:46.912719965 CEST	65451	25	192.168.2.10	67.195.228.109
Sep 6, 2024 09:47:48.912641048 CEST	65451	25	192.168.2.10	67.195.228.109
Sep 6, 2024 09:47:52.912672043 CEST	65451	25	192.168.2.10	67.195.228.109
Sep 6, 2024 09:48:00.912693024 CEST	65451	25	192.168.2.10	67.195.228.109
Sep 6, 2024 09:48:05.914643049 CEST	65452	25	192.168.2.10	142.251.168.27
Sep 6, 2024 09:48:06.912664890 CEST	65452	25	192.168.2.10	142.251.168.27
Sep 6, 2024 09:48:08.912739992 CEST	65452	25	192.168.2.10	142.251.168.27
Sep 6, 2024 09:48:09.053561926 CEST	49706	443	192.168.2.10	77.232.41.29
Sep 6, 2024 09:48:09.053633928 CEST	443	49706	77.232.41.29	192.168.2.10
Sep 6, 2024 09:48:09.053709030 CEST	49706	443	192.168.2.10	77.232.41.29
Sep 6, 2024 09:48:09.164203882 CEST	65453	443	192.168.2.10	77.232.41.29
Sep 6, 2024 09:48:09.164256096 CEST	443	65453	77.232.41.29	192.168.2.10
Sep 6, 2024 09:48:09.164376974 CEST	65453	443	192.168.2.10	77.232.41.29
Sep 6, 2024 09:48:12.912869930 CEST	65452	25	192.168.2.10	142.251.168.27
Sep 6, 2024 09:48:20.912738085 CEST	65452	25	192.168.2.10	142.251.168.27
Sep 6, 2024 09:48:26.553499937 CEST	65455	25	192.168.2.10	217.69.139.150
Sep 6, 2024 09:48:27.568968058 CEST	65455	25	192.168.2.10	217.69.139.150
Sep 6, 2024 09:48:29.584575891 CEST	65455	25	192.168.2.10	217.69.139.150
Sep 6, 2024 09:48:33.584621906 CEST	65455	25	192.168.2.10	217.69.139.150
Sep 6, 2024 09:48:41.584794044 CEST	65455	25	192.168.2.10	217.69.139.150
Sep 6, 2024 09:48:49.178486109 CEST	65453	443	192.168.2.10	77.232.41.29
Sep 6, 2024 09:48:49.178565025 CEST	443	65453	77.232.41.29	192.168.2.10
Sep 6, 2024 09:48:49.178657055 CEST	65453	443	192.168.2.10	77.232.41.29
Sep 6, 2024 09:48:49.288523912 CEST	65456	443	192.168.2.10	77.232.41.29
Sep 6, 2024 09:48:49.288599014 CEST	443	65456	77.232.41.29	192.168.2.10
Sep 6, 2024 09:48:49.288678885 CEST	65456	443	192.168.2.10	77.232.41.29

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 6, 2024 09:47:25.859498978 CEST	59930	53	192.168.2.10	1.1.1.1
Sep 6, 2024 09:47:25.890256882 CEST	53	59930	1.1.1.1	192.168.2.10
Sep 6, 2024 09:47:28.835510969 CEST	61998	53	192.168.2.10	1.1.1.1
Sep 6, 2024 09:47:29.038001060 CEST	53	61998	1.1.1.1	192.168.2.10
Sep 6, 2024 09:47:33.779006004 CEST	53	54716	1.1.1.1	192.168.2.10
Sep 6, 2024 09:47:45.882472038 CEST	62499	53	192.168.2.10	1.1.1.1
Sep 6, 2024 09:47:45.889719009 CEST	53	62499	1.1.1.1	192.168.2.10
Sep 6, 2024 09:47:45.890409946 CEST	64231	53	192.168.2.10	1.1.1.1
Sep 6, 2024 09:47:45.898046970 CEST	53	64231	1.1.1.1	192.168.2.10
Sep 6, 2024 09:48:05.897738934 CEST	64533	53	192.168.2.10	1.1.1.1
Sep 6, 2024 09:48:05.905121088 CEST	53	64533	1.1.1.1	192.168.2.10
Sep 6, 2024 09:48:05.906070948 CEST	54767	53	192.168.2.10	1.1.1.1
Sep 6, 2024 09:48:05.914035082 CEST	53	54767	1.1.1.1	192.168.2.10
Sep 6, 2024 09:48:25.928958893 CEST	63996	53	192.168.2.10	1.1.1.1
Sep 6, 2024 09:48:26.531683922 CEST	53	63996	1.1.1.1	192.168.2.10
Sep 6, 2024 09:48:26.535339117 CEST	57385	53	192.168.2.10	1.1.1.1
Sep 6, 2024 09:48:26.552733898 CEST	53	57385	1.1.1.1	192.168.2.10
Sep 6, 2024 09:49:19.190006018 CEST	58757	53	192.168.2.10	1.1.1.1
Sep 6, 2024 09:49:19.221368074 CEST	53	58757	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 6, 2024 09:47:25.859498978 CEST	192.168.2.10	1.1.1.1	0x1ea5	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:28.835510969 CEST	192.168.2.10	1.1.1.1	0xd8ae	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:45.882472038 CEST	192.168.2.10	1.1.1.1	0x5e55	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Sep 6, 2024 09:47:45.890409946 CEST	192.168.2.10	1.1.1.1	0x72b8	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:48:05.897738934 CEST	192.168.2.10	1.1.1.1	0x8320	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Sep 6, 2024 09:48:05.906070948 CEST	192.168.2.10	1.1.1.1	0x324	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:48:25.928958893 CEST	192.168.2.10	1.1.1.1	0x8ebe	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Sep 6, 2024 09:48:26.535339117 CEST	192.168.2.10	1.1.1.1	0xd11f	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:49:19.190006018 CEST	192.168.2.10	1.1.1.1	0xa80c	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 6, 2024 09:47:25.890256882 CEST	1.1.1.1	192.168.2.10	0x1ea5	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:25.890256882 CEST	1.1.1.1	192.168.2.10	0x1ea5	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:25.890256882 CEST	1.1.1.1	192.168.2.10	0x1ea5	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:25.890256882 CEST	1.1.1.1	192.168.2.10	0x1ea5	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:29.038001060 CEST	1.1.1.1	192.168.2.10	0xd8ae	No error (0)	vanaheim.cn	77.232.41.29	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:45.889719009 CEST	1.1.1.1	192.168.2.10	0x5e55	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 6, 2024 09:47:45.889719009 CEST	1.1.1.1	192.168.2.10	0x5e55	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 6, 2024 09:47:45.889719009 CEST	1.1.1.1	192.168.2.10	0x5e55	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 6, 2024 09:47:45.898046970 CEST	1.1.1.1	192.168.2.10	0x72b8	No error (0)	mta5.am0.yahoodns.net	67.195.228.109	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:45.898046970 CEST	1.1.1.1	192.168.2.10	0x72b8	No error (0)	mta5.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:45.898046970 CEST	1.1.1.1	192.168.2.10	0x72b8	No error (0)	mta5.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:45.898046970 CEST	1.1.1.1	192.168.2.10	0x72b8	No error (0)	mta5.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:45.898046970 CEST	1.1.1.1	192.168.2.10	0x72b8	No error (0)	mta5.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:45.898046970 CEST	1.1.1.1	192.168.2.10	0x72b8	No error (0)	mta5.am0.yahoodns.net	98.136.96.75	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:45.898046970 CEST	1.1.1.1	192.168.2.10	0x72b8	No error (0)	mta5.am0.yahoodns.net	67.195.204.72	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:47:45.898046970 CEST	1.1.1.1	192.168.2.10	0x72b8	No error (0)	mta5.am0.yahoodns.net	67.195.204.77	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:48:05.905121088 CEST	1.1.1.1	192.168.2.10	0x8320	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Sep 6, 2024 09:48:05.914035082 CEST	1.1.1.1	192.168.2.10	0x324	No error (0)	smtp.google.com	142.251.168.27	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:48:05.914035082 CEST	1.1.1.1	192.168.2.10	0x324	No error (0)	smtp.google.com	142.251.168.26	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:48:05.914035082 CEST	1.1.1.1	192.168.2.10	0x324	No error (0)	smtp.google.com	64.233.184.26	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:48:05.914035082 CEST	1.1.1.1	192.168.2.10	0x324	No error (0)	smtp.google.com	142.251.173.27	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:48:05.914035082 CEST	1.1.1.1	192.168.2.10	0x324	No error (0)	smtp.google.com	64.233.184.27	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:48:26.531683922 CEST	1.1.1.1	192.168.2.10	0x8ebe	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Sep 6, 2024 09:48:26.552733898 CEST	1.1.1.1	192.168.2.10	0xd11f	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:48:26.552733898 CEST	1.1.1.1	192.168.2.10	0xd11f	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:49:19.221368074 CEST	1.1.1.1	192.168.2.10	0xa80c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:49:19.221368074 CEST	1.1.1.1	192.168.2.10	0xa80c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:49:19.221368074 CEST	1.1.1.1	192.168.2.10	0xa80c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Sep 6, 2024 09:49:19.221368074 CEST	1.1.1.1	192.168.2.10	0xa80c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:47:11
Start date:	06/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	03:47:11
Start date:	06/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:47:11
Start date:	06/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:47:11
Start date:	06/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:47:12
Start date:	06/09/2024
Path:	C:\Users\user\Desktop\ODy57hA4Su.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ODy57hA4Su.exe"
Imagebase:	0x400000
File size:	219'136 bytes
MD5 hash:	8B9BE712BA5F26A1F6369833D52193FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000004.00000003.1327897456.0000000002080000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.1359133797.0000000000529000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:47:17
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\puwycifc\
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:47:17
Start date:	06/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:47:18
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\jhrsuqtz.exe" C:\Windows\SysWOW64\puwycifc\
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:47:18
Start date:	06/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:47:18
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create puwycifc binPath= "C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d\"C:\Users\user\Desktop\ODy57hA4Su.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xca0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:47:19
Start date:	06/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:47:19
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description puwycifc "wifi internet conection"
Imagebase:	0xca0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:47:19
Start date:	06/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:47:20
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start puwycifc
Imagebase:	0xca0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:47:20
Start date:	06/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:47:20
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe /d"C:\Users\user\Desktop\ODy57hA4Su.exe"
Imagebase:	0x400000
File size:	10'770'432 bytes
MD5 hash:	F5B76C95C1D9FC0EC3E2E435EB8464A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.1401015750.0000000000733000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000010.00000003.1400257997.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000010.00000002.1400962398.0000000000700000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:47:20
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1160000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:47:20
Start date:	06/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:47:24
Start date:	06/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x50000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	03:48:12
Start date:	06/09/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff6edd70000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:48:12
Start date:	06/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	26.5%
Total number of Nodes:	1552
Total number of Limit Nodes:	20

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

D, xrefs: 00409F8E
%X%08X, xrefs: 0040A0B0
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 0040A078
\, xrefs: 00409D0C
", xrefs: 0040A189
", xrefs: 00409EDB
P, xrefs: 00409DAA

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 5e9f80298255327e39bb5a43b3680402934ce1a896d3dc4b77bb4975c6ac572f
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 5e9f80298255327e39bb5a43b3680402934ce1a896d3dc4b77bb4975c6ac572f
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0041A630 Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 289
librarymemorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 0041A6EF
SetConsoleTitleA.KERNEL32(00000000), ref: 0041A6F7
GlobalSize.KERNEL32(00000000), ref: 0041A6FF
FindAtomW.KERNEL32(00000000), ref: 0041A707
SearchPathA.KERNEL32(0041C9B0,0041C998,0041C978,00000000,?,?), ref: 0041A72B
SetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A735
GetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A75D
CopyFileExA.KERNEL32(0041C9DC,0041C9CC,00000000,00000000,00000000,00000000), ref: 0041A775
GetEnvironmentStringsW.KERNEL32 ref: 0041A77B
WriteConsoleOutputW.KERNEL32(00000000,?,00000000,00000000,?), ref: 0041A79A
GetNumaProcessorNode.KERNEL32(00000000,00000000), ref: 0041A7A4
DebugActiveProcessStop.KERNEL32(00000000), ref: 0041A7AC
GetSystemDefaultLCID.KERNEL32 ref: 0041A7C6
RtlEnterCriticalSection.NTDLL(?), ref: 0041A7DA
LoadLibraryA.KERNEL32(00000000), ref: 0041A7F3
GetUserObjectInformationW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0041A844
GetSystemTimes.KERNELBASE(?,?,?), ref: 0041A859
FoldStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A881
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 0041A8A0
CallNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A8AD
GetComputerNameW.KERNEL32(00000000,00000000), ref: 0041A8B5
GetFileAttributesW.KERNEL32(00000000), ref: 0041A8BC
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041A8C2
GlobalAlloc.KERNELBASE(00000000,00421FFC), ref: 0041A90C

Strings

}$, xrefs: 0041A9C1
k`, xrefs: 0041A99D
W9@, xrefs: 0041A6B8

Memory Dump Source

Source File: 00000004.00000002.1358812255.0000000000415000.00000020.00000001.01000000.00000004.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_415000_ODy57hA4Su.jbxd

Similarity

API ID: Console$DefaultFileGlobalLengthSystem$ActiveAliasAliasesAllocAtomAttributesCallCommComputerConfigCopyCriticalDebugEnterEnvironmentExchangeExesFindFoldInformationInterlockedLibraryLoadModeNameNamedNodeNumaObjectOutputPathPipeProcessProcessorSearchSectionSizeStopStringStringsTimesTitleUserWrite
String ID: W9@$k`$}$
API String ID: 414751691-3186663488
Opcode ID: 3125ac5748dbd4fbce1368805dc9991385e2cf29a0c5f3b6033c5a1e3b709f57
Instruction ID: 38aa9030d850b5c0fa977c86cdfdbc856e4cc6e92616535b5e60fdfa969bb4c8
Opcode Fuzzy Hash: 3125ac5748dbd4fbce1368805dc9991385e2cf29a0c5f3b6033c5a1e3b709f57
Instruction Fuzzy Hash: 90A127B1641310ABD320AB61DC4AFDB7B64EB4C715F01843AF669A61E0CBB85541CBEF

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,774C8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 004F092B Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 004F095F
GetProcAddress., xrefs: 004F09DC, 004F09DF, 004F09E4
l, xrefs: 004F0966

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: ee8d9548c56cb374e40298a9480588cf3b25a9a1b09fae618662e7862dfbde42
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: E3316EB6900609DFDB10CF99C880AAEBBF5FF48324F54404AD541A7312D7B5EA45CFA4

Function 0052A4B6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0052A4DE
Module32First.KERNEL32(00000000,00000224), ref: 0052A4FE

Memory Dump Source

Source File: 00000004.00000002.1359133797.0000000000529000.00000040.00000020.00020000.00000000.sdmp, Offset: 00529000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_529000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: bba7b4a44bd498cfc9c4ebba674808dd3facb0fb5cbaff6b6734f397329b5a27
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 30F068312007216FDB203BB5A88DA6B7AE8BF4A725F100529E642D14C0D7B0EC458652

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,774D0F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,774D0F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,774D0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,774D0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,774D0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,774D0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,774D0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 92594f354633bb88517f7acf4746756fc69952fce073fe57c9bbb1d804d07feb
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 92594f354633bb88517f7acf4746756fc69952fce073fe57c9bbb1d804d07feb
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,774D0F10,?,774D0F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(774D0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,774D0F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(774D0F10,?,774D0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(774D0F10), ref: 00407208
RegCloseKey.ADVAPI32(774D0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(774D0F10), ref: 004072D0
RegCloseKey.ADVAPI32(774D0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(774D0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
, xrefs: 00407194

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,774D0F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,774D0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,774D0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,774D0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,774D0F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,774D0F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,774D0F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,774D0F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,774D0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,774D0F10,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,774D0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 004F003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 004F024D

Strings

cess, xrefs: 004F018D
kernel32.dll, xrefs: 004F008F, 004F0095

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 83880b094ae64c264b2fc075c34aefdff4589c7d83e42e366babc69d92f96334
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 6E527A74A01229DFDB64CF58C984BA9BBB1BF09304F1480DAE50DAB352DB34AE85DF15

Function 0041A933 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(0041CA40), ref: 0041A961
GlobalSize.KERNEL32(00000000), ref: 0041A98B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0041A9BA

Strings

}$, xrefs: 0041A9C1
k`, xrefs: 0041A99D

Memory Dump Source

Source File: 00000004.00000002.1358812255.0000000000415000.00000020.00000001.01000000.00000004.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_415000_ODy57hA4Su.jbxd

Similarity

API ID: ExchangeGlobalInterlockedLibraryLoadSize
String ID: k`$}$
API String ID: 1230614907-956986773
Opcode ID: d3d032c72053aceecd28de272ac849355dd5813b76bd1eed268e775e1403a36a
Instruction ID: 87d718edd81fec5578da447485a1248bdf804c4c94e660229896a94c6f6a257a
Opcode Fuzzy Hash: d3d032c72053aceecd28de272ac849355dd5813b76bd1eed268e775e1403a36a
Instruction Fuzzy Hash: 33115B706552108BC7309B20DC42BDFB750EB49315F02483FE6A9862A1CB7854E18BDF

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,774C8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 0041A350 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00421ED0), ref: 0041A3EE
GetProcAddress.KERNEL32(00000000,00420640), ref: 0041A421
VirtualProtect.KERNELBASE(00421D1C,00421FFC,00000040,?), ref: 0041A440

Strings

, xrefs: 0041A386

Memory Dump Source

Source File: 00000004.00000002.1358812255.0000000000415000.00000020.00000001.01000000.00000004.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_415000_ODy57hA4Su.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: 301b48656fdeabb88a85c72d70f5d368dde583ca559c2ddd4d3b112bc4849b32
Instruction ID: d1e14fb232e0ed7b86ecf6662b745481911f37886fb3b6d0d712552d8374243e
Opcode Fuzzy Hash: 301b48656fdeabb88a85c72d70f5d368dde583ca559c2ddd4d3b112bc4849b32
Instruction Fuzzy Hash: 9E113774728344DAD330CF64FD45B063AB5EBA4704F81503DD8088B2B2D7B61526C75E

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: f879f8fadec04f6bf6b1199d3439cd872fe94bd0f9ee82a20ab95112746dcfee
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: f879f8fadec04f6bf6b1199d3439cd872fe94bd0f9ee82a20ab95112746dcfee
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 004F0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,004F0223,?,?), ref: 004F0E19
SetErrorMode.KERNELBASE(00000000,?,?,004F0223,?,?), ref: 004F0E1E

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 0f54c85112c70c8300c1c69f5b337ed9408a1e8e4429274e0b8fc5c206ebf4b7
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 37D0123154512CB7D7002A94DC09BDE7B1CDF05B62F008411FB0DD9181C774994046E9

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 004F0920 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 004F0929

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 3c70e2495a12ff6ae4c515c261271d7c947c2eb84b30f042f73628172fd7eedf
Instruction ID: 1318691bb2f91343321d018af63213c0b44ed3bcc8f8abdb047d49f21bb7817d
Opcode Fuzzy Hash: 3c70e2495a12ff6ae4c515c261271d7c947c2eb84b30f042f73628172fd7eedf
Instruction Fuzzy Hash: 8190026828415071D920659C0C01B9501452742630F3407507130996D0D441A6005115

Function 0052A175 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0052A1C6

Memory Dump Source

Source File: 00000004.00000002.1359133797.0000000000529000.00000040.00000020.00020000.00000000.sdmp, Offset: 00529000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_529000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 1cb39530bc3e531852dc37a637de4558697bdbb93d05794b5fe6a9f2abb6df15
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 5D113F79A00208EFDB01DF98C985E98BFF5AF08350F058094F9489B361D771EA50DF91

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

wtm_w, xrefs: 0040C96C
4, xrefs: 0040D9F7
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
flags_upd, xrefs: 0040CE4A
wtm_r, xrefs: 0040C97F
srv_time, xrefs: 0040CABB
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
\, xrefs: 0040D3A7
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
.sys, xrefs: 0040D0CC
lid_file_upd, xrefs: 0040CE6A
drivers\, xrefs: 0040D067
local_time, xrefs: 0040CACD
@, xrefs: 0040D754
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
wtm_c, xrefs: 0040C956
\, xrefs: 0040D39D
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 44f18751907ac83f0597d90c4008e51201f03a759b9f1f15cdb9985a75ef01ab
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 44f18751907ac83f0597d90c4008e51201f03a759b9f1f15cdb9985a75ef01ab
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtClose, xrefs: 004011B4
NtDuplicateToken, xrefs: 004011F3
NtSetInformationToken, xrefs: 00401175
RtlSetLastWin32Error, xrefs: 004010D6
NtFilterToken, xrefs: 0040122B
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlFreeSid, xrefs: 00401116
NtTerminateProcess, xrefs: 004010F6
NtSetInformationThread, xrefs: 00401155
RtlLengthSid, xrefs: 00401246
NtQueryInformationToken, xrefs: 00401262
ntdll.dll, xrefs: 0040100D
RtlInitUnicodeString, xrefs: 00401135
NtOpenProcessToken, xrefs: 004011D4
RtlNtStatusToDosError, xrefs: 00401194
RtlAllocateAndInitializeSid, xrefs: 0040120F

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(?,?), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(?,?), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Thu, xrefs: 0040B241
Jul, xrefs: 0040B280
Feb, xrefs: 0040B25D
Jun, xrefs: 0040B279
Wed, xrefs: 0040B23A
Sat, xrefs: 0040B24F
Nov, xrefs: 0040B29C
Oct, xrefs: 0040B295
Dec, xrefs: 0040B2A3
Aug, xrefs: 0040B287
Mar, xrefs: 0040B264
May, xrefs: 0040B272
Sep, xrefs: 0040B28E
Tue, xrefs: 0040B233
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Apr, xrefs: 0040B26B
Sun, xrefs: 0040B225
Jan, xrefs: 0040B256
Fri, xrefs: 0040B248
Mon, xrefs: 0040B22C

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
<, xrefs: 00401378
uac, xrefs: 00401628
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316
D, xrefs: 004015C6
, xrefs: 00401462
useless, xrefs: 0040161E

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: a61a7175f41a72e4ed55554bcbe8f28090feb92d632b3ceef371416ca030a5a9
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: a61a7175f41a72e4ed55554bcbe8f28090feb92d632b3ceef371416ca030a5a9
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

start_srv, xrefs: 00401E6C
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
loader_id, xrefs: 00401F4B, 00401F6B
IsWow64Process, xrefs: 00401DF2
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
kernel32, xrefs: 00401DF7
lid_file_upd, xrefs: 00401E25
born_date, xrefs: 00401EAD, 00401ECC
work_srv, xrefs: 00401E5E
net_type, xrefs: 00401E87

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,774CF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,774CF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 004F65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 004F65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 004F6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004F6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004F6652

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 3d2a489c04368c9cbaf241e53be49382c160a194b09cb0f6ade92607c0483def
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 9911777160021CBFEB115F65DC46FAB3FA8EF057A5F114025FA04E7251DBB5DD0086A8

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: dafa446f11e7c98dbfd5716669028cf329551362ce1bec339b6002f1eaca3cb4
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: dafa446f11e7c98dbfd5716669028cf329551362ce1bec339b6002f1eaca3cb4
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 00529D93 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1359133797.0000000000529000.00000040.00000020.00020000.00000000.sdmp, Offset: 00529000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_529000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: fc7c4541889a1a62e8f990618541f372558db32837fc29df7cb9c0da196cf9be
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 07117C72340110AFD744DE55EC81FA677EAFF8A320B298065ED08CB352E675EC01C760

Function 004F0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 2b3fd6cf4533f3a8e818fb1884d4457831b369b992358946cb87bab4cba5e53e
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3701A7766016088FDF21CF64C904BBB33E5FBD6316F4544A6DA0697342E778A9418B94

Function 004F9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 004F9E6D
lstrcpy.KERNEL32(?,00000000), ref: 004F9FE1
lstrcat.KERNEL32(?,?), ref: 004F9FF2
lstrcat.KERNEL32(?,0041070C), ref: 004FA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 004FA054
DeleteFileA.KERNEL32(?), ref: 004FA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 004FA0D6
lstrcpy.KERNEL32 ref: 004FA12F
lstrlen.KERNEL32(00000022), ref: 004FA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 004F9F13

Part of subcall function 004F7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 004F7081

Part of subcall function 004F6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\uzbdhnkh,004F7043), ref: 004F6F4E
Part of subcall function 004F6F30: GetProcAddress.KERNEL32(00000000), ref: 004F6F55
Part of subcall function 004F6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 004F6F7B
Part of subcall function 004F6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 004F6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 004FA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 004FA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 004FA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 004FA21B
GetDriveTypeA.KERNEL32(?), ref: 004FA265
lstrcat.KERNEL32(?,00000000), ref: 004FA29F
lstrcat.KERNEL32(?,00410A34), ref: 004FA2C5
lstrcat.KERNEL32(?,00000022), ref: 004FA2D9
lstrcat.KERNEL32(?,00410A34), ref: 004FA2F4
wsprintfA.USER32 ref: 004FA31D
lstrcat.KERNEL32(?,00000000), ref: 004FA345
lstrcat.KERNEL32(?,?), ref: 004FA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 004FA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 004FA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 004FA1D1

Part of subcall function 004F9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 004F999D
Part of subcall function 004F9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 004F99BD
Part of subcall function 004F9966: RegCloseKey.ADVAPI32(?), ref: 004F99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 004FA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 004FA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 004FA41D

Strings

P, xrefs: 004FA011
", xrefs: 004FA2DF
", xrefs: 004FA3F0
D, xrefs: 004FA1F5
\, xrefs: 004F9F73
", xrefs: 004FA142

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 2ffde47dd54e4c769b2d19119485e3fcddbc16ea6cd932aa3910f51df4df4fc8
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 52F143B1D4025DAFDB11DBA19C49EFF77BCAB08304F0440AAE709E2141E7798A958F69

Function 004F7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 004F7D21
GetUserNameA.ADVAPI32(?,?), ref: 004F7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 004F7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 004F7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 004F7DC0
EqualSid.ADVAPI32(?,?), ref: 004F7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 004F7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004F7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 004F7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 004F7E12
LocalFree.KERNEL32(00000000), ref: 004F7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 004F7E35

Strings

PromptOnSecureDesktop, xrefs: 004F7FA0
D, xrefs: 004F7D73

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: ea1d42171a28daf055a40cde6cb00c9ff3dc6cf8f1263e0251a775b1504ff7f1
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 76A13F7190021DAFDB118FA5DD44FFFBBB9FB08344F14806AE605E6250DB798A85CB68

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

plgs:, xrefs: 004066AA
Jan 13 2018, xrefs: 0040653A
except_info, xrefs: 00406728
va=%08X%08X uef=%p, xrefs: 00406595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
localcfg, xrefs: 0040672D
%d=%p, xrefs: 004066F9
12:08:32, xrefs: 00406535
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Too big smtp respons (%d bytes), xrefs: 0040A9B1
AUTH LOGIN, xrefs: 0040A80C
Too small respons, xrefs: 0040A9C9
ehlo %s, xrefs: 0040A7F5
localcfg, xrefs: 0040AB0B
helo %s, xrefs: 0040A803
rcpt to:<%s>, xrefs: 0040A855
., xrefs: 0040A8CA
Incorrect respons, xrefs: 0040AB39
mail from:<%s>, xrefs: 0040A848
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
data, xrefs: 0040A85E
ESMTP, xrefs: 0040AA38
quit, xrefs: 0040A86C

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: e28565558cb0d863a75f1a8c28663d7dfa8bdf35cbf6dace20ad3122ce5fd1be
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: e28565558cb0d863a75f1a8c28663d7dfa8bdf35cbf6dace20ad3122ce5fd1be
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 004F7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 004F7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 004F7ACD
GetLengthSid.ADVAPI32(?), ref: 004F7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 004F7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 004F7B1F
EqualSid.ADVAPI32(?,?), ref: 004F7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 004F7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004F7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 004F7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 004F7B77
LocalFree.KERNEL32(00000000), ref: 004F7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 004F7B9A
GetAce.ADVAPI32(?,?,?), ref: 004F7BCA
EqualSid.ADVAPI32(?,?), ref: 004F7BF1
DeleteAce.ADVAPI32(?,?), ref: 004F7C0A
EqualSid.ADVAPI32(?,?), ref: 004F7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 004F7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004F7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 004F7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 004F7CE0
LocalFree.KERNEL32(00000000), ref: 004F7CEE

Strings

D, xrefs: 004F7AC3

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 3a77c08836b2857502a4331bd1c43677ec5dba8743c4b6fa9e450600431a176b
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 22814C7190425DAFDB11CFA5DD84FEFBBB8AF08304F04816AE605E6250D77D9A41CB68

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetBestInterface, xrefs: 004019EF
GetIfEntry, xrefs: 004019E4
Iphlpapi.dll, xrefs: 004019B7
localcfg, xrefs: 004019A3
123.45.67.89, xrefs: 004019A6
GetAdaptersInfo, xrefs: 004019DC

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 004F858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 004F865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 004F867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 004F86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 004F86B1

Strings

PromptOnSecureDesktop, xrefs: 004F85B6, 004F8645, 004F86BD, 004F8708, 004F87C5, 004F8812, 004F88E9, 004F8905
", xrefs: 004F896C

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 13b6a96038e49e2e0561472811a8f5809e967612b16a72ff371618e4fa206fc4
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: EAC193B190014DBEEB11ABA5DD85EFF7BBCEB04304F14406BF704E6151EBB84A948B69

Function 004F14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 004F1601
lstrlenW.KERNEL32(-00000003), ref: 004F17D8

Strings

@, xrefs: 004F15E7
<, xrefs: 004F15DF
D, xrefs: 004F182D
, xrefs: 004F16C9

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 4f38943b211d619e45123ff6ecd7bcfd579e589b8859e339c5c43777515776ed
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: ECF17EB1508345DFD720DF64C888BABB7E4FB88305F10892EF695973A0D7B89944CB5A

Function 004F7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 004F76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 004F7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 004F778F
___ascii_stricmp.LIBCMT ref: 004F78B4
RegCloseKey.ADVAPI32(?), ref: 004F794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 004F796D
RegCloseKey.ADVAPI32(?), ref: 004F797E
RegCloseKey.ADVAPI32(?), ref: 004F79AC
RegCloseKey.ADVAPI32(?), ref: 004F7A56

Part of subcall function 004FF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,004F772A,?), ref: 004FF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 004F79F6
RegCloseKey.ADVAPI32(?), ref: 004F7A4D

Strings

PromptOnSecureDesktop, xrefs: 004F76C5, 004F76CA, 004F76E5, 004F7782, 004F77E6, 004F7862, 004F787B, 004F79C2
", xrefs: 004F7800

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: b7d7fbb2bcfe76e1160e64506605014bfb8a98073b1c3a8017e003ac4af67037
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 58C1907190410DAFEB119BA5DC45FFF7BB9EF44310F1040A6F604E6291EB7D9A848B68

Function 004F2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 004F2CED
socket.WS2_32(00000002,00000002,00000011), ref: 004F2D07
htons.WS2_32(00000000), ref: 004F2D42
select.WS2_32 ref: 004F2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 004F2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 004F2E62

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: fe4fb87d7601f2fd91a0b706c162eb07f145459fea63cb9560095bed5cc1e38f
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: AB61E071904309ABC3209F61DD08B7BBBF8FB48345F14481AFA8497251D7F9DC819BAA

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(?), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(?), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(?,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_MID, xrefs: 0040AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
127.0.0.1, xrefs: 0040ADEB
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,774D23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 004F958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 004F95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 004F95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 004F95DC
wsprintfA.USER32 ref: 004F9635
wsprintfA.USER32 ref: 004F9673
wsprintfA.USER32 ref: 004F96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004F9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 004F978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 004F97D8

Strings

PromptOnSecureDesktop, xrefs: 004F9604, 004F9624, 004F9662, 004F9683, 004F96B6, 004F96DF, 004F9701, 004F9734, 004F9780, 004F97B7

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 98deaf7c5838cbf721e26b5b367791dc2f6e7d541a7b9671d3c0c5c237431ea8
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: EFA162B194020CFBEB21EFA1CC45FEB3BACAB05745F10402BFA1596151D7B9D9848BA9

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
86A, xrefs: 0040BF98
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62
06A, xrefs: 0040BF70

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 9bc1f6eaf859e488329790364f54f8d8fb956d111e5ea2dcff1f0b71cefcbf58
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 9bc1f6eaf859e488329790364f54f8d8fb956d111e5ea2dcff1f0b71cefcbf58
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 004F1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 004F202D
GetSystemInfo.KERNEL32(?), ref: 004F204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 004F206A
GetProcAddress.KERNEL32(00000000), ref: 004F2071
GetCurrentProcess.KERNEL32(?), ref: 004F2082
GetTickCount.KERNEL32 ref: 004F2230

Part of subcall function 004F1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 004F1E7C

Strings

flags_upd, xrefs: 004F20A5, 004F20AA, 004F20E3
hi_id, xrefs: 004F217D, 004F2182, 004F219A
localcfg, xrefs: 004F2091, 004F2098, 004F20AB, 004F20E4, 004F20F3, 004F2119, 004F2138, 004F214E, 004F2166, 004F2183, 004F219B, 004F21B7, 004F21D7
work_srv, xrefs: 004F20C5

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: b201ba42d2266534c8f949ccfebaff9bb139850c90abc1a8f922a605970e66d5
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 3651B37090034CAFE330AF668D85F777AECEB44708F00491EFB9682252D6BDA944876D

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7597EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7597EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040B3F8 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 124COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_EMAIL, xrefs: 0040B473
%s@%s, xrefs: 0040B461
%TO_HASH, xrefs: 0040B4B0
%TO_USER, xrefs: 0040B488
%FROM_DOMAIN, xrefs: 0040B41E
%M5DATE, xrefs: 0040B50F
%P5DATE, xrefs: 0040B4F2
%FROM_USER, xrefs: 0040B431
%DATE, xrefs: 0040B4D2
%TO_DOMAIN, xrefs: 0040B44B

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-3679488032
Opcode ID: ac16611c4fddf8c3cf7e82f2ce1d8bd22cf067ce21d7c8c5ccb760e75c026233
Instruction ID: bd7dfe77e026ff01e11c6618f048304d5953ff5d6b37f7005ea1b6d17bf081bd
Opcode Fuzzy Hash: ac16611c4fddf8c3cf7e82f2ce1d8bd22cf067ce21d7c8c5ccb760e75c026233
Instruction Fuzzy Hash: 263197B25401197ADF016B96CCC2DFFBB6CEF49348B14052BF904B1182EB789A6587E9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 004F3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 004F3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 004F3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 004F3095
RtlAllocateHeap.NTDLL(00000000), ref: 004F30B6
htons.WS2_32(00000035), ref: 004F30EF
inet_addr.WS2_32(?), ref: 004F30FA
gethostbyname.WS2_32(?), ref: 004F310D
HeapFree.KERNEL32(00000000), ref: 004F314D

Strings

iphlpapi.dll, xrefs: 004F3062, 004F3067, 004F3077

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 1b80e58119854fd95caef1ad574c322ffafcfe858b6fabc86d724f1e94225403
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 7C317531A0060EABDB119FB49D48ABF7778AF05762F144126E618E7390DB78DA41CB5C

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,774D23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 004F6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 004F67C3
htonl.WS2_32(?), ref: 004F67DF
htonl.WS2_32(?), ref: 004F67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 004F68F1
ExitProcess.KERNEL32 ref: 004F69BC

Strings

except_info, xrefs: 004F698F
localcfg, xrefs: 004F6994

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 000b64f7a03637e269b0d8c612a2001354bdc82a721d6b8b29d726a0ec5003c4
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 46615071940208AFDB609FB4DC45FEA77E9FF08300F14806AFA6DD2161DAB59994CF54

Function 004FF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(004FCC84), ref: 004FF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 004FF5CE
closesocket.WS2_32(00000000), ref: 004FF5DC

Strings

time_cfg, xrefs: 004FF58A

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 1cb1a44a7499f170dc734182cf7d32bda00229a38ead1bb4a8ebfe62165e5797
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 1C315E7190011CABDB10DFA5DC85DEF7BBCEF48310F10456AFA15D3150E7749A868BA9

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 0d12a7b496ace9c0c99c0276ab90a72f2bda41479394b1ea55399d50714db434
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: 0d12a7b496ace9c0c99c0276ab90a72f2bda41479394b1ea55399d50714db434
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 004F2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 004F2FA1
LoadLibraryA.KERNEL32(?), ref: 004F2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 004F2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 004F3000
RtlAllocateHeap.NTDLL(00000000), ref: 004F3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 004F3032

Strings

dnsapi.dll, xrefs: 004F2F90

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 752f38ae74552d3b36b59895a24eed5170453ee010ae7f445c185af8568c9611
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 8521627194162ABBCB219F55DC449BFBBB8EF08B51F104422FA05E7240D7B89E8197E8

Function 004F6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\uzbdhnkh,004F7043), ref: 004F6F4E
GetProcAddress.KERNEL32(00000000), ref: 004F6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 004F6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 004F6F92

Strings

\\.\pipe\uzbdhnkh, xrefs: 004F6F37
PromptOnSecureDesktop, xrefs: 004F6F9D, 004F6FBF, 004F6FCF, 004F6FE5, 004F6FF5
C:\Windows\SysWOW64\, xrefs: 004F6F30, 004F6F38, 004F6F65, 004F6F6C, 004F6F7A, 004F6F85, 004F6F91, 004F6FA9, 004F6FC6, 004F6FEC

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\uzbdhnkh
API String ID: 1082366364-1824400605
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: fbc83f6f683bc6f5d8e0667ec7e99a7ad985f1f877650edb813cd02fa6329aff
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: B52104217443487EF7225731AD89FFB2E4C8F52714F1840AAF704D5292DADD88DA827D

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 004F92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 004F92E2
wsprintfA.USER32 ref: 004F9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 004F9375
lstrlen.KERNEL32(?,?,00000000), ref: 004F9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 004F9394
CloseHandle.KERNEL32(00000000), ref: 004F939B

Strings

PromptOnSecureDesktop, xrefs: 004F932B, 004F9343, 004F935E

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: e57c8f7dead29f136ba56e90991f335a8b74234e30bce7290562de04d4912349
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: F51175B56401187BE7206732DC0EFFF3A6DDFC8B15F00806ABB05A5091EAB84A458669

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 004F99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 004F9A18
GetThreadContext.KERNEL32(?,?), ref: 004F9A52
TerminateProcess.KERNEL32(?,00000000), ref: 004F9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 004F9A98
SetThreadContext.KERNEL32(?,00010002), ref: 004F9AB5
ResumeThread.KERNEL32(?), ref: 004F9AC2

Strings

D, xrefs: 004F9A10

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 5061966d04c3ade6eac9b78a4c1e3723a6885e93e111f1cfbbf2169db5174c06
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 19212C71E0111DBBDB119BA1DC09FEF7BBCEF04750F404062BA19E1150EB758A44CAA8

Function 004F1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 004F1C18
LoadLibraryA.KERNEL32(004102C8), ref: 004F1C26
GetProcessHeap.KERNEL32 ref: 004F1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 004F1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 004F1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 004F1D02
FreeLibrary.KERNEL32(?), ref: 004F1D0B

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 5e5a31f444ac4164fad746dd10f82749229f408dbe41f399d5a468b32378a64e
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 4F313E31D0025DFFDB119FA4DC888BFBAB9EB45711B24447BE601A2220D7B95E80DB98

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: 1d5f752cf5e4d4e7205d8b51b4cea38d33843a7f37b29257b789d56d7c64f5a9
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: 1d5f752cf5e4d4e7205d8b51b4cea38d33843a7f37b29257b789d56d7c64f5a9
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 004F6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004F6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 004F6D22
GetLastError.KERNEL32 ref: 004F6DA7
CloseHandle.KERNEL32(?), ref: 004F6DB5
GetLastError.KERNEL32 ref: 004F6DD6
DeleteFileA.KERNEL32(?), ref: 004F6DE7
GetLastError.KERNEL32 ref: 004F6DFD

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 5818ecba3b80d87adcd53d380b3a1b22c3901d8e57b31c1c1088cb5ae76473a8
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 8D31F076A0024DBFCB01DFA49D48AEF7F79EF48300F15816AE311E3221D7748A858B69

Function 004FE2FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,004FE50A,00000000,00000000,00000000,00020106,00000000,004FE50A,00000000,000000E4), ref: 004FE319
RegSetValueExA.ADVAPI32(004FE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 004FE38E
RegDeleteValueA.ADVAPI32(004FE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,DO), ref: 004FE3BF
RegCloseKey.ADVAPI32(004FE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,DO,004FE50A), ref: 004FE3C8

Strings

PromptOnSecureDesktop, xrefs: 004FE33A
DO, xrefs: 004FE2FC

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop$DO
API String ID: 2667537340-4234893205
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 033a8570c2f0a12c211eac4fc2b39da4a029b890c7bf759ab30f60348c26398e
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 29217F31A0021DABDF209FA5EC89EEF7F78EF08750F048022FA04E6161E2718A54D795

Function 0041A4E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

BuildCommDCBW.KERNEL32(00000000,?), ref: 0041A50D
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A525
UnhandledExceptionFilter.KERNEL32(00000000), ref: 0041A52D
GetComputerNameW.KERNEL32(?,?), ref: 0041A577
GetShortPathNameA.KERNEL32(00000000,?,00000000), ref: 0041A588

Strings

-, xrefs: 0041A595

Memory Dump Source

Source File: 00000004.00000002.1358812255.0000000000415000.00000020.00000001.01000000.00000004.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_415000_ODy57hA4Su.jbxd

Similarity

API ID: Name$BuildCommComputerExceptionFilterPathPrivateProfileShortStringUnhandledWrite
String ID: -
API String ID: 2733835202-2547889144
Opcode ID: dd34520314507014667174f0e6434c3dbda5242ed859e180898910edffc3a613
Instruction ID: 3cde9b8d507e75d165a48e7d4f5241052d71a567071430f553e1f5bb8a0b190c
Opcode Fuzzy Hash: dd34520314507014667174f0e6434c3dbda5242ed859e180898910edffc3a613
Instruction Fuzzy Hash: C121E770545214BBEB209F64DC85FEE7BB5EB4C320F5041A9F6099A181CF785AC48F5A

Function 004F93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 004F93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 004F93CD
CharToOemA.USER32(?,?), ref: 004F93DB
wsprintfA.USER32 ref: 004F9410

Part of subcall function 004F92CB: GetTempPathA.KERNEL32(00000400,?), ref: 004F92E2
Part of subcall function 004F92CB: wsprintfA.USER32 ref: 004F9350
Part of subcall function 004F92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 004F9375
Part of subcall function 004F92CB: lstrlen.KERNEL32(?,?,00000000), ref: 004F9389
Part of subcall function 004F92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 004F9394
Part of subcall function 004F92CB: CloseHandle.KERNEL32(00000000), ref: 004F939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004F9448

Strings

PromptOnSecureDesktop, xrefs: 004F93FA, 004F93FF, 004F941C

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: dc98a73525188daaa68b68e0e676f8eb6908c8a93ecfbefd388ad01e7e2decb4
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 830152F69001187BD721A7619D49FEF377CDB95705F0040A6BB49E2080DAB89AC58F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 004FAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 004FAAE5

Strings

, xrefs: 004FABB3
localcfg, xrefs: 004FAD72

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: abe62a84cd552543387306661d6b7713cf87420bb1596c48ace48a0de67840f1
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: EF71F9F190034CAADF219A54DC85BFF376A9B00349F244027FB0CA6191DB6D5DA8875F

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 2e8906757388b0cc02cf4226a1faca2848dce0e0b6cc783beaf2f73dd01b3536
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 2e8906757388b0cc02cf4226a1faca2848dce0e0b6cc783beaf2f73dd01b3536
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 004FE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004FDF6C: GetCurrentThreadId.KERNEL32 ref: 004FDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 004FE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,004F6128), ref: 004FE950
lstrcmp.KERNEL32(?,00000008), ref: 004FE989

Strings

A, xrefs: 004FE960, 004FE965
A, xrefs: 004FE9A0
A, xrefs: 004FE8C6, 004FE8CD, 004FE936, 004FE998

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 2312fd1faa4fb61235753830451277c640a72c4adca758d620778e074cbb9dc7
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 6F31A371600709DBCB718F26C884F777BE4EB05712F10852BE75587661D3B8E880C76A

Function 004F6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 004F6E19

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 7118eb35368bf444dc22d30405b066ddb8f8be7a6666ea8fdfc1b5fdcb8963d8
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 7A218E7720411DBFDB109B71FC49EEF3FADDB49365B218426F602D1091EB799A009678

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,774D0F10,?,00000000,0040E538,?,774D0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 004FC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004FC6B4
InterlockedIncrement.KERNEL32(004FC74B), ref: 004FC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,004FC747), ref: 004FC728
CloseHandle.KERNEL32(00000000,?,004FC747,00413588,004F8A77), ref: 004FC733

Strings

localcfg, xrefs: 004FC544

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 1baa1e8a33070bf9f4f1f1e3df23bead3bfd7e010cf1ccaa7439cd7379f67a11
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 86515CB1A04B499FD7249F29C6C452ABBE9FB48304B50593FE28BC7A90D778F844CB54

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,774D0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,774D0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,774D0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,774D0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,774D0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,774D0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,774D0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: a7fe28dd04f73a45cf24fffff85a70117338552789dad14eeac3c005c8f16141
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: a7fe28dd04f73a45cf24fffff85a70117338552789dad14eeac3c005c8f16141
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 004F71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 004F71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 004F7228
LocalFree.KERNEL32(?,?,?), ref: 004F7286
wsprintfA.USER32 ref: 004F729D

Strings

|, xrefs: 004F721A

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: bda2ee3966f3e839f10813a0e4ea6b2234f65371954c34e7729082207cf8e4f2
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 93312D7290410CBFDB01DFA9DD45AEB7BACEF04314F14C066F959DB201EA79DA488B98

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(?), ref: 0040AD60
lstrlenA.KERNEL32(?), ref: 0040AD69
lstrcpyA.KERNEL32(?,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 004FB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004FB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 004FB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 004FB548
GetTimeZoneInformation.KERNEL32(?), ref: 004FB590
wsprintfA.USER32 ref: 004FB61E

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 2fe3ef36c844b5928c07eb47ceb0f482e766f23d7b6ba70341d9ca0295f94f8d
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 40510DB1D0021DAACF14DFD5D8895FEBBB9EF49304F10816BE605A6150E7B84AC9CF98

Function 004F62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 004F6303
LoadLibraryA.KERNEL32(?), ref: 004F632A
GetProcAddress.KERNEL32(00000000,?), ref: 004F63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 004F6405

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 79e5c7c47ad47ffcd8d22154af752f8fb427822527447ecedae1f5c54b7c3a9a
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 5A416B71A00219ABDB14CF58C884ABAB7B8EF04318F26816AEE15D7390D779ED41CB58

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981fb48902faec8b3b60e951c7ac5498972a27d8d4857947259acf027c15d2af
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 981fb48902faec8b3b60e951c7ac5498972a27d8d4857947259acf027c15d2af
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(774D0F18,00000000,?,774D0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,774D0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,774D0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 004FE3DE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,DO,00000000,00000000,00000000), ref: 004FE470
CloseHandle.KERNEL32(00000001,00000003), ref: 004FE484

Part of subcall function 004FE2FC: RegCreateKeyExA.ADVAPI32(80000001,004FE50A,00000000,00000000,00000000,00020106,00000000,004FE50A,00000000,000000E4), ref: 004FE319
Part of subcall function 004FE2FC: RegSetValueExA.ADVAPI32(004FE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 004FE38E
Part of subcall function 004FE2FC: RegDeleteValueA.ADVAPI32(004FE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,DO), ref: 004FE3BF
Part of subcall function 004FE2FC: RegCloseKey.ADVAPI32(004FE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,DO,004FE50A), ref: 004FE3C8

Strings

PromptOnSecureDesktop, xrefs: 004FE4F1, 004FE4F6, 004FE537, 004FE561
DO, xrefs: 004FE498, 004FE4BD, 004FE41A, 004FE447, 004FE4C0, 004FE41D, 004FE459, 004FE45A, 004FE46C, 004FE49B

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop$DO
API String ID: 4151426672-4234893205
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 2243ee16565b54a06db42869e932ccad39558382e0132938269ee55100bc7ad1
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 7341AD7590021CBADB206A578C46FFB3B5CDB04719F14806BFB09541A2E7B98650DA79

Function 004FE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004FDF6C: GetCurrentThreadId.KERNEL32 ref: 004FDFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,004FA6AC), ref: 004FE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,004FA6AC), ref: 004FE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,004FA6AC), ref: 004FE819

Strings

PromptOnSecureDesktop, xrefs: 004FE840, 004FE845, 004FE87C, 004FE89B

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 4cd32e913f89254808d1cb34a8a23a615734358c5e8914441b5a680cab90b221
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 0521D8B1A403087AF22077239C07FBB3D5CDB65765F10002ABB09A52E3EA9D945085BD

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,774D0F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,774D0F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,774D0F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 004F7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 004F76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 004F796D
RegCloseKey.ADVAPI32(?), ref: 004F797E

Strings

PromptOnSecureDesktop, xrefs: 004F76C5, 004F76CA, 004F76E5

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 1b3ecd276ef450457476236e676d40991131170286f1dfa589fcebe27b7aac02
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 3A11DF70A04109AFEB119FA9DC45EBFBFB8EF41314F140166F610E6291E6BC8D508B65

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 004F9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 004F999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 004F99BD
RegCloseKey.ADVAPI32(?), ref: 004F99C6

Strings

PromptOnSecureDesktop, xrefs: 004F9989, 004F998E, 004F99B0, 004F99D3

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: d2ae8455c005ecac14211c1267ad6c222b3d8847037c700753b84e348c758501
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: ACF0C2B2680208BBF7106B51AC07FEB3A2CDB94B14F100065FB05B5192F6E99E9086BD

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 004F28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 004F28FA
gethostbyname.WS2_32(u6A), ref: 004F2906

Strings

u6A, xrefs: 004F28EC, 004F28F9, 004F2905
time_cfg, xrefs: 004F28EB

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 3f57ddd7ce856b20265f54b178e08ab626aedde501f9a6e087a4f6c66af60312
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: C3E0C2306041118FCB009B2CF848AE637E4EF0A330F008282F140D32A0C7B8DCC09748

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 004F417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 004F41AB
GetLastError.KERNEL32 ref: 004F41B5
WaitForSingleObject.KERNEL32(?,?), ref: 004F41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 004F41D9

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: c1ad0319f58c736313c7f55dcaf748ef48109260b895808148768c3e3d246e2f
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: E301ED7651110EABDF01DF90DE48BEF7B6CEB14355F104062FA01E2150DB749B948BB5

Function 004F41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 004F421F
GetLastError.KERNEL32 ref: 004F4229
WaitForSingleObject.KERNEL32(?,?), ref: 004F423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 004F424D

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 20ab6485db327f38d1afdba8647025253439fb405e5ea3bd3ee04bab6cdd1b69
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: DF01E57251110DABDF01DF90ED84BEF7BACEB48395F1180A2FA01E2150DB749A548BBA

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 004FE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 004FE066

Strings

A, xrefs: 004FE036
A, xrefs: 004FE07F
A, xrefs: 004FE037, 004FE03C

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: e7b54b269bd975ecf6c268b9c78e465f45b0432d8365167a536d7bc95e054224
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 8DF068312007159FCB20CF16D884993B7E9FB05322B54872BE254C3170D7B8A895CB59

Function 0041A5C0 Relevance: 6.0, APIs: 4, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,00000000,00000000,00000000,0041B03C,0041A971), ref: 0041A5DC
FreeEnvironmentStringsW.KERNEL32(00000000,00000000,0041B03C,0041A971), ref: 0041A5F7
RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 0041A61A
GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 0041A622

Memory Dump Source

Source File: 00000004.00000002.1358812255.0000000000415000.00000020.00000001.01000000.00000004.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_415000_ODy57hA4Su.jbxd

Similarity

API ID: AllocateDeviceEnvironmentFreeHeapHighestNodeNumaNumberQueryStrings
String ID:
API String ID: 975556166-0
Opcode ID: fc213b24a92c472580c126cfe80f9bbfcf6dd46c5811944ea437593e0904f25d
Instruction ID: 494602ce712dfe78f3d2314fcb4a20314ccfb6bfbb70b33752429d16c64ce78c
Opcode Fuzzy Hash: fc213b24a92c472580c126cfe80f9bbfcf6dd46c5811944ea437593e0904f25d
Instruction Fuzzy Hash: 9AF08235785214ABEA30A764EC4AF963764E71C71AF908032F629962E0C7E419818B5E

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 004F8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 004F83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 004F8477

Part of subcall function 004FEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,004F1DCF,?), ref: 004FEEA8
Part of subcall function 004FEE95: HeapFree.KERNEL32(00000000), ref: 004FEEAF

Strings

PromptOnSecureDesktop, xrefs: 004F83B2, 004F83B7, 004F8483

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heap$CloseFreeOpenProcess
String ID: PromptOnSecureDesktop
API String ID: 1016092768-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 15eabb04d9a0f338da5f9a3b6ed7734192b326edac87b599bb9fee0eff06daab
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 88414FB290010DBFEB10EBA59E81DFF776CEB04344F1444AFE704DA151FAB85A948B69

Function 004FE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,004FE859,00000000,00020119,004FE859,PromptOnSecureDesktop), ref: 004FE64D
RegCloseKey.ADVAPI32(004FE859,?,?,?,?,000000C8,000000E4), ref: 004FE787

Strings

PromptOnSecureDesktop, xrefs: 004FE637

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 7bf0b80484dc1f10577ef00e1aefcc40991aee74db86b677bd639604d91b513e
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 544136B2D0021DBFDF11EF95DC81DFEBBB9EB18305F144466FA00A6260E3759A158B64

Function 004FAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004FAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 004FB00D

Part of subcall function 004FAF6F: gethostname.WS2_32(?,00000080), ref: 004FAF83
Part of subcall function 004FAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 004FAFE6

Part of subcall function 004F331C: gethostname.WS2_32(?,00000080), ref: 004F333F
Part of subcall function 004F331C: gethostbyname.WS2_32(?), ref: 004F3349

Part of subcall function 004FAA0A: inet_ntoa.WS2_32(00000000), ref: 004FAA10

Strings

%OUTLOOK_BND_, xrefs: 004FB076, 004FB07B, 004FB0BE, 004FB0DD

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: ce171d7b1d8faf3d4ffefc8ec69d7f5db91540ec8096925f34a2fdcfb3692a52
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: C441F27290024CAFDB25EFA1DC45EEF376CFF04304F14442BBA1592152EA79DA548B59

Function 004F9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 004F9536
Sleep.KERNEL32(000001F4), ref: 004F955D

Strings

, xrefs: 004F94D9

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 93ddff0d47361538ec320533c38acb0d7229fd527ce85b28950f0aa9866c0a34
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 0B410972C0839D7FEB378B68D89C7B73FA49B12314F1411A7D682572A2D67C4D82871A

Function 004FBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004FB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 004FBA3A
InterlockedIncrement.KERNEL32(?), ref: 004FBA94
GetTickCount.KERNEL32 ref: 004FBB79
GetTickCount.KERNEL32 ref: 004FBB99
InterlockedIncrement.KERNEL32(?), ref: 004FBE15
closesocket.WS2_32(00000000), ref: 004FBEB4

Strings

%FROM_EMAIL, xrefs: 004FBC7D

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: a9380e48b204f9793c8e0569ebe854eecdd0ec2e3877409a8ee24c83d275f561
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: D0316B7150024CDFDF25DFA5DC84AFA77A8EB49700F20405BFB2482161DB38DA85CB99

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 004F709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 004F70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 004F70F4

Strings

|, xrefs: 004F70E6

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 3325a2a6d500b6316e92254cb11cee5939a818b4a82ea789fafef7d08fd46b3a
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0C11E87290411CEBDF11CFD4DD84AEFB7BDEB04711F1441A6E601E6290D6789B88DBA4

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7597EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 004F3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004F2F88: GetModuleHandleA.KERNEL32(?), ref: 004F2FA1
Part of subcall function 004F2F88: LoadLibraryA.KERNEL32(?), ref: 004F2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 004F31DA
HeapFree.KERNEL32(00000000), ref: 004F31E1

Memory Dump Source

Source File: 00000004.00000002.1359005988.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4f0000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 8f056bec72f794e08633c106ef10aa4cfa7ac2e701ea5e72f38a866c3bc4f77a
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 8F51DC3190020AAFCF01DF64D8889FAB775FF05305F1440AAED96C7211EB36DA19CB98

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,774D23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000004.00000002.1358768698.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1358768698.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ODy57hA4Su.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: ddc1366e71bb2e66961e885791bb3d9f2ae4384e5350e4f1bce6563879376d33
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: ddc1366e71bb2e66961e885791bb3d9f2ae4384e5350e4f1bce6563879376d33
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: jhrsuqtz.exePID: 1244, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	2.3%
Signature Coverage:	0%
Total number of Nodes:	1571
Total number of Limit Nodes:	15

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\ODy57hA4Su.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

%X%08X, xrefs: 0040A0B0
\, xrefs: 00409D0C
puwycifc, xrefs: 0040A389, 0040A397
", xrefs: 0040A189
C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 0040A1D9
P, xrefs: 00409DAA
C:\Users\user\Desktop\ODy57hA4Su.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
D, xrefs: 00409F8E
", xrefs: 00409EDB
", xrefs: 0040A078

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\ODy57hA4Su.exe$C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe$D$P$\$puwycifc
API String ID: 2089075347-3041349192
Opcode ID: 210f584047e2a3557edc0ac511e6dc12bb7f949e626bf56cb8d544fe5afb1cee
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 210f584047e2a3557edc0ac511e6dc12bb7f949e626bf56cb8d544fe5afb1cee
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0041A630 Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 289
librarymemorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 0041A6EF
SetConsoleTitleA.KERNEL32(00000000), ref: 0041A6F7
GlobalSize.KERNEL32(00000000), ref: 0041A6FF
FindAtomW.KERNEL32(00000000), ref: 0041A707
SearchPathA.KERNEL32(0041C9B0,0041C998,0041C978,00000000,?,?), ref: 0041A72B
SetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A735
GetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A75D
CopyFileExA.KERNEL32(0041C9DC,0041C9CC,00000000,00000000,00000000,00000000), ref: 0041A775
GetEnvironmentStringsW.KERNEL32 ref: 0041A77B
WriteConsoleOutputW.KERNEL32(00000000,?,00000000,00000000,?), ref: 0041A79A
GetNumaProcessorNode.KERNEL32(00000000,00000000), ref: 0041A7A4
DebugActiveProcessStop.KERNEL32(00000000), ref: 0041A7AC
GetSystemDefaultLCID.KERNEL32 ref: 0041A7C6
RtlEnterCriticalSection.NTDLL(?), ref: 0041A7DA
LoadLibraryA.KERNEL32(00000000), ref: 0041A7F3
GetUserObjectInformationW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0041A844
GetSystemTimes.KERNELBASE(?,?,?), ref: 0041A859
FoldStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A881
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 0041A8A0
CallNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A8AD
GetComputerNameW.KERNEL32(00000000,00000000), ref: 0041A8B5
GetFileAttributesW.KERNEL32(00000000), ref: 0041A8BC
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041A8C2
GlobalAlloc.KERNELBASE(00000000,00421FFC), ref: 0041A90C

Strings

}$, xrefs: 0041A9C1
W9@, xrefs: 0041A6B8
k`, xrefs: 0041A99D

Memory Dump Source

Source File: 00000010.00000002.1400747790.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_415000_jhrsuqtz.jbxd

Similarity

API ID: Console$DefaultFileGlobalLengthSystem$ActiveAliasAliasesAllocAtomAttributesCallCommComputerConfigCopyCriticalDebugEnterEnvironmentExchangeExesFindFoldInformationInterlockedLibraryLoadModeNameNamedNodeNumaObjectOutputPathPipeProcessProcessorSearchSectionSizeStopStringStringsTimesTitleUserWrite
String ID: W9@$k`$}$
API String ID: 414751691-3186663488
Opcode ID: 3125ac5748dbd4fbce1368805dc9991385e2cf29a0c5f3b6033c5a1e3b709f57
Instruction ID: 38aa9030d850b5c0fa977c86cdfdbc856e4cc6e92616535b5e60fdfa969bb4c8
Opcode Fuzzy Hash: 3125ac5748dbd4fbce1368805dc9991385e2cf29a0c5f3b6033c5a1e3b709f57
Instruction Fuzzy Hash: 90A127B1641310ABD320AB61DC4AFDB7B64EB4C715F01843AF669A61E0CBB85541CBEF

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: dafa446f11e7c98dbfd5716669028cf329551362ce1bec339b6002f1eaca3cb4
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: dafa446f11e7c98dbfd5716669028cf329551362ce1bec339b6002f1eaca3cb4
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,774D0F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,774D0F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,774D0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,774D0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,774D0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,774D0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,774D0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 92594f354633bb88517f7acf4746756fc69952fce073fe57c9bbb1d804d07feb
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 92594f354633bb88517f7acf4746756fc69952fce073fe57c9bbb1d804d07feb
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 005B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005B024D

Strings

cess, xrefs: 005B018D
kernel32.dll, xrefs: 005B008F, 005B0095

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 7551dfa21bb43cba0658288d1fd6cf974fef82f8ba6c86bf0450c771147d3be8
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 4F526874A00229DFDB64CF58C985BADBBB1BF09304F1480D9E94DAB291DB30AE85DF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 0041A933 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(0041CA40), ref: 0041A961
GlobalSize.KERNEL32(00000000), ref: 0041A98B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0041A9BA

Strings

}$, xrefs: 0041A9C1
k`, xrefs: 0041A99D

Memory Dump Source

Source File: 00000010.00000002.1400747790.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_415000_jhrsuqtz.jbxd

Similarity

API ID: ExchangeGlobalInterlockedLibraryLoadSize
String ID: k`$}$
API String ID: 1230614907-956986773
Opcode ID: d3d032c72053aceecd28de272ac849355dd5813b76bd1eed268e775e1403a36a
Instruction ID: 87d718edd81fec5578da447485a1248bdf804c4c94e660229896a94c6f6a257a
Opcode Fuzzy Hash: d3d032c72053aceecd28de272ac849355dd5813b76bd1eed268e775e1403a36a
Instruction Fuzzy Hash: 33115B706552108BC7309B20DC42BDFB750EB49315F02483FE6A9862A1CB7854E18BDF

Function 0041A350 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00421ED0), ref: 0041A3EE
GetProcAddress.KERNEL32(00000000,00420640), ref: 0041A421
VirtualProtect.KERNELBASE(00421D1C,00421FFC,00000040,?), ref: 0041A440

Strings

, xrefs: 0041A386

Memory Dump Source

Source File: 00000010.00000002.1400747790.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_415000_jhrsuqtz.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: 301b48656fdeabb88a85c72d70f5d368dde583ca559c2ddd4d3b112bc4849b32
Instruction ID: d1e14fb232e0ed7b86ecf6662b745481911f37886fb3b6d0d712552d8374243e
Opcode Fuzzy Hash: 301b48656fdeabb88a85c72d70f5d368dde583ca559c2ddd4d3b112bc4849b32
Instruction Fuzzy Hash: 9E113774728344DAD330CF64FD45B063AB5EBA4704F81503DD8088B2B2D7B61526C75E

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 0073427E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 007342A6
Module32First.KERNEL32(00000000,00000224), ref: 007342C6

Memory Dump Source

Source File: 00000010.00000002.1401015750.0000000000733000.00000040.00000020.00020000.00000000.sdmp, Offset: 00733000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_733000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 8d8d12552539f7f95671994d4ef753e5a3e9b15dae3c27badfd65ac177fb9944
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 73F062325007116BE7242AB5988DA6BB6E8BF49724F500528F652A15C1DA78FC454A61

Function 005B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005B0223,?,?), ref: 005B0E19
SetErrorMode.KERNELBASE(00000000,?,?,005B0223,?,?), ref: 005B0E1E

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: e6f0b986f79c47f2df78b5900a9022620743f9650b9358d5e1040a707868e860
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0FD0123114512877D7002A94DC09BCE7F1CDF05B62F008411FB0DD9080C770994046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 005B0920 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 005B0929

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 3c70e2495a12ff6ae4c515c261271d7c947c2eb84b30f042f73628172fd7eedf
Instruction ID: 1318691bb2f91343321d018af63213c0b44ed3bcc8f8abdb047d49f21bb7817d
Opcode Fuzzy Hash: 3c70e2495a12ff6ae4c515c261271d7c947c2eb84b30f042f73628172fd7eedf
Instruction Fuzzy Hash: 8190026828415071D920659C0C01B9501452742630F3407507130996D0D441A6005115

Function 00733F3D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00733F8E

Memory Dump Source

Source File: 00000010.00000002.1401015750.0000000000733000.00000040.00000020.00020000.00000000.sdmp, Offset: 00733000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_733000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 53476ded5673290fbf3c25291527333713b1e8a71d0de80dce0534d7fbf5e50e
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 3F113C79A40208EFDB01DF98C989E99BFF5AF08350F058094F9489B362D375EA50DF80

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 005B65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 005B65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 005B6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 005B6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 005B6652

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 211ac597fde7f9ce83e2b7338cbc43df44649eb770c08912bbd277b8e9b786c0
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: AE119171600219BFDB219F65DC0AFDB3FA8FB047A5F104024F908A7291E7B5ED0087A4

Function 005B9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 005B9E6D
lstrcpy.KERNEL32(?,00000000), ref: 005B9FE1
lstrcat.KERNEL32(?,?), ref: 005B9FF2
lstrcat.KERNEL32(?,0041070C), ref: 005BA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 005BA054
DeleteFileA.KERNEL32(?), ref: 005BA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 005BA0D6
lstrcpy.KERNEL32 ref: 005BA12F
lstrlen.KERNEL32(00000022), ref: 005BA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 005B9F13

Part of subcall function 005B7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 005B7081

Part of subcall function 005B6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\uzbdhnkh,005B7043), ref: 005B6F4E
Part of subcall function 005B6F30: GetProcAddress.KERNEL32(00000000), ref: 005B6F55
Part of subcall function 005B6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 005B6F7B
Part of subcall function 005B6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 005B6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 005BA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 005BA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 005BA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 005BA21B
GetDriveTypeA.KERNEL32(?), ref: 005BA265
lstrcat.KERNEL32(?,00000000), ref: 005BA29F
lstrcat.KERNEL32(?,00410A34), ref: 005BA2C5
lstrcat.KERNEL32(?,00000022), ref: 005BA2D9
lstrcat.KERNEL32(?,00410A34), ref: 005BA2F4
wsprintfA.USER32 ref: 005BA31D
lstrcat.KERNEL32(?,00000000), ref: 005BA345
lstrcat.KERNEL32(?,?), ref: 005BA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 005BA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 005BA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 005BA1D1

Part of subcall function 005B9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 005B999D
Part of subcall function 005B9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 005B99BD
Part of subcall function 005B9966: RegCloseKey.ADVAPI32(?), ref: 005B99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 005BA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 005BA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 005BA41D

Strings

", xrefs: 005BA2DF
", xrefs: 005BA142
", xrefs: 005BA3F0
D, xrefs: 005BA1F5
\, xrefs: 005B9F73
P, xrefs: 005BA011

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: a7d2f1e89181ed54af55cc229a0be5392a42b56b9c59c68d928cbaeee599c0c6
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 34F130B1D4025DAFDF21DBA08C49EEE7FBCBB48300F1484A6F605E2151E775AA848F65

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlSetLastWin32Error, xrefs: 004010D6
NtSetInformationToken, xrefs: 00401175
RtlFreeSid, xrefs: 00401116
NtSetInformationThread, xrefs: 00401155
NtDuplicateToken, xrefs: 004011F3
NtFilterToken, xrefs: 0040122B
ntdll.dll, xrefs: 0040100D
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlInitUnicodeString, xrefs: 00401135
NtClose, xrefs: 004011B4
NtQueryInformationToken, xrefs: 00401262
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtOpenProcessToken, xrefs: 004011D4
RtlLengthSid, xrefs: 00401246
NtTerminateProcess, xrefs: 004010F6
RtlNtStatusToDosError, xrefs: 00401194

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(?,?), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(?,?), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Oct, xrefs: 0040B295
Mar, xrefs: 0040B264
Apr, xrefs: 0040B26B
Sat, xrefs: 0040B24F
Tue, xrefs: 0040B233
Sep, xrefs: 0040B28E
Aug, xrefs: 0040B287
Fri, xrefs: 0040B248
Nov, xrefs: 0040B29C
Jan, xrefs: 0040B256
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Dec, xrefs: 0040B2A3
Thu, xrefs: 0040B241
Jun, xrefs: 0040B279
Feb, xrefs: 0040B25D
May, xrefs: 0040B272
Mon, xrefs: 0040B22C
Jul, xrefs: 0040B280
Sun, xrefs: 0040B225
Wed, xrefs: 0040B23A

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 005B7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 005B7D21
GetUserNameA.ADVAPI32(?,?), ref: 005B7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005B7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 005B7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 005B7DC0
EqualSid.ADVAPI32(?,?), ref: 005B7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 005B7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005B7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 005B7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 005B7E12
LocalFree.KERNEL32(00000000), ref: 005B7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005B7E35

Strings

D, xrefs: 005B7D73
C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 005B7F49, 005B7F76, 005B7F8A, 005B7F8B

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe$D
API String ID: 2976863881-3064012573
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: cefb486b5b680c260e05d7decbf669bbe41ea7f30ff57d5c5bc1a323ecec37ec
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: BAA13A7190021DAFDB119FA0DD88BEEBFBDFB48340F14806AE505E6150EB75AA85CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe$D
API String ID: 2976863881-3064012573
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

va=%08X%08X uef=%p, xrefs: 00406595
localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
plgs:, xrefs: 004066AA
%d=%p, xrefs: 004066F9
12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728
Jan 13 2018, xrefs: 0040653A

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Too big smtp respons (%d bytes), xrefs: 0040A9B1
ESMTP, xrefs: 0040AA38
mail from:<%s>, xrefs: 0040A848
ehlo %s, xrefs: 0040A7F5
AUTH LOGIN, xrefs: 0040A80C
Incorrect respons, xrefs: 0040AB39
data, xrefs: 0040A85E
localcfg, xrefs: 0040AB0B
helo %s, xrefs: 0040A803
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
., xrefs: 0040A8CA
quit, xrefs: 0040A86C
rcpt to:<%s>, xrefs: 0040A855
Too small respons, xrefs: 0040A9C9

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: e28565558cb0d863a75f1a8c28663d7dfa8bdf35cbf6dace20ad3122ce5fd1be
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: e28565558cb0d863a75f1a8c28663d7dfa8bdf35cbf6dace20ad3122ce5fd1be
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 005B7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005B7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005B7ACD
GetLengthSid.ADVAPI32(?), ref: 005B7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 005B7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 005B7B1F
EqualSid.ADVAPI32(?,?), ref: 005B7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 005B7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005B7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 005B7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 005B7B77
LocalFree.KERNEL32(00000000), ref: 005B7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005B7B9A
GetAce.ADVAPI32(?,?,?), ref: 005B7BCA
EqualSid.ADVAPI32(?,?), ref: 005B7BF1
DeleteAce.ADVAPI32(?,?), ref: 005B7C0A
EqualSid.ADVAPI32(?,?), ref: 005B7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 005B7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 005B7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 005B7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 005B7CE0
LocalFree.KERNEL32(00000000), ref: 005B7CEE

Strings

D, xrefs: 005B7AC3

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 89b3d1f8087c37c346829e3a0b83553d8ab56ba6775a03c85c3b5456b34aceab
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: B6812A7190421EABDB11CFA4DD88BEEBFB8BF4C300F14806AE515E6150E775AA45CF64

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe$localcfg
API String ID: 237177642-3136575136
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

D, xrefs: 004015C6
%systemroot%\system32\cmd.exe, xrefs: 00401316
<, xrefs: 00401378
useless, xrefs: 0040161E
wusa.exe, xrefs: 00401388
@, xrefs: 00401380
uac, xrefs: 00401628
, xrefs: 00401462

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: a61a7175f41a72e4ed55554bcbe8f28090feb92d632b3ceef371416ca030a5a9
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: a61a7175f41a72e4ed55554bcbe8f28090feb92d632b3ceef371416ca030a5a9
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
lid_file_upd, xrefs: 00401E25
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
loader_id, xrefs: 00401F4B, 00401F6B
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
work_srv, xrefs: 00401E5E
net_type, xrefs: 00401E87
IsWow64Process, xrefs: 00401DF2
start_srv, xrefs: 00401E6C
kernel32, xrefs: 00401DF7
born_date, xrefs: 00401EAD, 00401ECC

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

localcfg, xrefs: 004019A3
GetIfEntry, xrefs: 004019E4
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC
123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 005B858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 005B865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 005B867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 005B86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 005B86B1

Strings

C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 005B882F, 005B883C, 005B884C
", xrefs: 005B896C

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe
API String ID: 237177642-3625079511
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 85821c3d8349f5c2c54631db15a9b20db35bdab4210c84fb822d7bcb9cd761ab
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 71C1AF7190020DBFEB11ABA4DC89EFE7FBCFB58300F144466F601E2051EA71AA84CB65

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,774CF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,774CF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 005B14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 005B1601
lstrlenW.KERNEL32(-00000003), ref: 005B17D8

Strings

, xrefs: 005B16C9
D, xrefs: 005B182D
@, xrefs: 005B15E7
<, xrefs: 005B15DF

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 0478a2caa60d847de6afc4da6a5c1a5d88685d59e1e2ea3119b4fab534bac4a6
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: DEF18DB15087819FD720CF64C898BEBBBE4FB88304F50892DF59697290D7B4E944CB5A

Function 005B7666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 005B76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 005B7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 005B778F
___ascii_stricmp.LIBCMT ref: 005B78B4
RegCloseKey.ADVAPI32(?), ref: 005B794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 005B796D
RegCloseKey.ADVAPI32(?), ref: 005B797E
RegCloseKey.ADVAPI32(?), ref: 005B79AC
RegCloseKey.ADVAPI32(?), ref: 005B7A56

Part of subcall function 005BF40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,005B772A,?), ref: 005BF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 005B79F6
RegCloseKey.ADVAPI32(?), ref: 005B7A4D

Strings

", xrefs: 005B7800

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 14f9732c337209aa73aea5edd104c929df46266ba869ff8c445462af3ff76271
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 80C1717290420EAFDB119BA4DC49FEE7FB9FF89310F1440A5F505E6191EB71AA848B60

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,774D0F10,?,774D0F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(774D0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,774D0F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(774D0F10,?,774D0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(774D0F10), ref: 00407208
RegCloseKey.ADVAPI32(774D0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(774D0F10), ref: 004072D0
RegCloseKey.ADVAPI32(774D0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(774D0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 005B2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 005B2CED
socket.WS2_32(00000002,00000002,00000011), ref: 005B2D07
htons.WS2_32(00000000), ref: 005B2D42
select.WS2_32 ref: 005B2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 005B2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 005B2E62

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: e67ff8fbd2cadab23183ffcaf0608f3f78c5a4bcb9df411f2a892b25876b9489
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 2D61CE71508305ABC720AF65DC09BFBBFE8FB88341F104819F98496251D7B4E8818BB6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(?), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(?), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(?,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_MID, xrefs: 0040AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
127.0.0.1, xrefs: 0040ADEB
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,774D23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,774D0F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,774D0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,774D0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,774D0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,774D0F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,774D0F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,774D0F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,774D0F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,774D0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,774D0F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,774D0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 005B1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 005B202D
GetSystemInfo.KERNEL32(?), ref: 005B204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 005B206A
GetProcAddress.KERNEL32(00000000), ref: 005B2071
GetCurrentProcess.KERNEL32(?), ref: 005B2082
GetTickCount.KERNEL32 ref: 005B2230

Part of subcall function 005B1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 005B1E7C

Strings

hi_id, xrefs: 005B217D, 005B2182, 005B219A
work_srv, xrefs: 005B20C5
flags_upd, xrefs: 005B20A5, 005B20AA, 005B20E3
localcfg, xrefs: 005B2091, 005B2098, 005B20AB, 005B20E4, 005B20F3, 005B2119, 005B2138, 005B214E, 005B2166, 005B2183, 005B219B, 005B21B7, 005B21D7

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 2b252d354e93ad2067bb63dba5d330ae86db85dc8bea79181c75966064412eb6
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 0551C2B0500749AFE320AF658C8AFE7BEECFB84704F04492DF99692142D6B9B944C775

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7597EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7597EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040B3F8 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 124COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s@%s, xrefs: 0040B461
%M5DATE, xrefs: 0040B50F
%TO_USER, xrefs: 0040B488
%P5DATE, xrefs: 0040B4F2
%TO_EMAIL, xrefs: 0040B473
%TO_DOMAIN, xrefs: 0040B44B
%TO_HASH, xrefs: 0040B4B0
%FROM_DOMAIN, xrefs: 0040B41E
%DATE, xrefs: 0040B4D2
%FROM_USER, xrefs: 0040B431

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-3679488032
Opcode ID: ac16611c4fddf8c3cf7e82f2ce1d8bd22cf067ce21d7c8c5ccb760e75c026233
Instruction ID: bd7dfe77e026ff01e11c6618f048304d5953ff5d6b37f7005ea1b6d17bf081bd
Opcode Fuzzy Hash: ac16611c4fddf8c3cf7e82f2ce1d8bd22cf067ce21d7c8c5ccb760e75c026233
Instruction Fuzzy Hash: 263197B25401197ADF016B96CCC2DFFBB6CEF49348B14052BF904B1182EB789A6587E9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 005B3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 005B3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 005B3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 005B3095
RtlAllocateHeap.NTDLL(00000000), ref: 005B30B6
htons.WS2_32(00000035), ref: 005B30EF
inet_addr.WS2_32(?), ref: 005B30FA
gethostbyname.WS2_32(?), ref: 005B310D
HeapFree.KERNEL32(00000000), ref: 005B314D

Strings

iphlpapi.dll, xrefs: 005B3062, 005B3067, 005B3077

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: b3f9f70ca6d8991288c699e43f262cda0016f8682bd8e67a18eb20bb5b2c0807
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: F1314331A0060AABDB119BB89C48AEE7FBCBF05761F144165E518F7290DB74EA41CB58

Function 005B958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 005B95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005B95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 005B95DC
wsprintfA.USER32 ref: 005B9635
wsprintfA.USER32 ref: 005B9673
wsprintfA.USER32 ref: 005B96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 005B9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 005B978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 005B97D8

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: a542cc43369465f5bf6131ba8fda483b4b66301481c61cb5793809328b6c73d7
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 52A17EB194020DAFEB21DFA0DC49FDA3FACFB45741F104026FA1596152E7B5E984CBA4

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,774D23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 9bc1f6eaf859e488329790364f54f8d8fb956d111e5ea2dcff1f0b71cefcbf58
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 9bc1f6eaf859e488329790364f54f8d8fb956d111e5ea2dcff1f0b71cefcbf58
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,774C8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 005B6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 005B67C3
htonl.WS2_32(?), ref: 005B67DF
htonl.WS2_32(?), ref: 005B67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 005B68F1
ExitProcess.KERNEL32 ref: 005B69BC

Strings

localcfg, xrefs: 005B6994
except_info, xrefs: 005B698F

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: d4a9b0e2127745ba7997dc03925d5dfde377ad9a2a57506eba5529799c59dca6
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 8A616072940208AFDB609FB4DC45FEA7BE9FF48300F148066FA6DD2161DA75A990CF54

Function 005BF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(005BCC84), ref: 005BF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 005BF5CE
closesocket.WS2_32(00000000), ref: 005BF5DC

Strings

time_cfg, xrefs: 005BF58A

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: a44898ad5f234a90a7fc399be8b9dc11e02b1153f014cf1e7250ec6210b0f23a
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: B1315A76900119ABDB10DFA5EC89DEEBBBCFF88310F104576F915E3150E770AA818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 0d12a7b496ace9c0c99c0276ab90a72f2bda41479394b1ea55399d50714db434
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: 0d12a7b496ace9c0c99c0276ab90a72f2bda41479394b1ea55399d50714db434
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 005B2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 005B2FA1
LoadLibraryA.KERNEL32(?), ref: 005B2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 005B2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 005B3000
RtlAllocateHeap.NTDLL(00000000), ref: 005B3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 005B3032

Strings

dnsapi.dll, xrefs: 005B2F90

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 21b02c1c65e1e1676c498bff04207cf1531c4fb951c195246e60656f2ed366f5
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 1A217171901629BBCB219B55DC89AEEBFBCFF08B50F114421F905E7140D7B4AE8187E4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 005B99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 005B9A18
GetThreadContext.KERNEL32(?,?), ref: 005B9A52
TerminateProcess.KERNEL32(?,00000000), ref: 005B9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 005B9A98
SetThreadContext.KERNEL32(?,00010002), ref: 005B9AB5
ResumeThread.KERNEL32(?), ref: 005B9AC2

Strings

D, xrefs: 005B9A10

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 984aecad86bb3164374d4f423bbc5856349b0097d64044014bc29e6e7bf60c95
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 74213BB1A01219BBDB219BA1DC09EEFBFBCFF04750F404061BA19E1050E7759A84CBA4

Function 005B1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 005B1C18
LoadLibraryA.KERNEL32(004102C8), ref: 005B1C26
GetProcessHeap.KERNEL32 ref: 005B1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 005B1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 005B1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 005B1D02
FreeLibrary.KERNEL32(?), ref: 005B1D0B

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 95aac3d67d17b037f8798fd2b5d1486c03c1aa139e80297ce5ebd4bffeae7742
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: E0315832E00609BFCB519FA4DC988EEBFB9FB45301BA4447AE501E6110D7B55E80DB98

Function 005B6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 005B6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 005B6D22
GetLastError.KERNEL32 ref: 005B6DA7
CloseHandle.KERNEL32(?), ref: 005B6DB5
GetLastError.KERNEL32 ref: 005B6DD6
DeleteFileA.KERNEL32(?), ref: 005B6DE7
GetLastError.KERNEL32 ref: 005B6DFD

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 09ac034078e2bbb6fe46456f48667fc9cc08356b33edb250541a630f36315235
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 65310176A00249BFCB01DFA4DD49AEE7F79FB88300F148076E211E3211D774AA858B61

Function 005B6F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\uzbdhnkh,005B7043), ref: 005B6F4E
GetProcAddress.KERNEL32(00000000), ref: 005B6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 005B6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 005B6F92

Strings

\\.\pipe\uzbdhnkh, xrefs: 005B6F37
C:\Windows\SysWOW64\, xrefs: 005B6F30, 005B6F38, 005B6F65, 005B6F6C, 005B6F7A, 005B6F85, 005B6F91, 005B6FA9, 005B6FC6, 005B6FEC

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\uzbdhnkh
API String ID: 1082366364-1442287239
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: d1bbfdfb6a423775b5617643ceb55a75d7aaa48b03f7f04b6d33d1192128ce0b
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 472138217443497EF7226335AC8DFFB2E4CAB96710F1880A5F504D5091DADDA8D6837D

Function 0041A4E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

BuildCommDCBW.KERNEL32(00000000,?), ref: 0041A50D
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A525
UnhandledExceptionFilter.KERNEL32(00000000), ref: 0041A52D
GetComputerNameW.KERNEL32(?,?), ref: 0041A577
GetShortPathNameA.KERNEL32(00000000,?,00000000), ref: 0041A588

Strings

-, xrefs: 0041A595

Memory Dump Source

Source File: 00000010.00000002.1400747790.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_415000_jhrsuqtz.jbxd

Similarity

API ID: Name$BuildCommComputerExceptionFilterPathPrivateProfileShortStringUnhandledWrite
String ID: -
API String ID: 2733835202-2547889144
Opcode ID: dd34520314507014667174f0e6434c3dbda5242ed859e180898910edffc3a613
Instruction ID: 3cde9b8d507e75d165a48e7d4f5241052d71a567071430f553e1f5bb8a0b190c
Opcode Fuzzy Hash: dd34520314507014667174f0e6434c3dbda5242ed859e180898910edffc3a613
Instruction Fuzzy Hash: C121E770545214BBEB209F64DC85FEE7BB5EB4C320F5041A9F6099A181CF785AC48F5A

Function 005BAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 005BAAE5

Strings

, xrefs: 005BABB3
localcfg, xrefs: 005BAD72

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: a9c276c1b2eb92f59efa1c75ce5a6d4a443d1dbc568957a1db4178f691e32482
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 59712872A40309BEEF319B58DC8AFEE3F69BB40705F244427F905A6091DA72BD848757

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 2e8906757388b0cc02cf4226a1faca2848dce0e0b6cc783beaf2f73dd01b3536
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 2e8906757388b0cc02cf4226a1faca2848dce0e0b6cc783beaf2f73dd01b3536
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 005BE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005BDF6C: GetCurrentThreadId.KERNEL32 ref: 005BDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 005BE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,005B6128), ref: 005BE950
lstrcmp.KERNEL32(?,00000008), ref: 005BE989

Strings

A, xrefs: 005BE960, 005BE965
A, xrefs: 005BE9A0
A, xrefs: 005BE8C6, 005BE8CD, 005BE936, 005BE998

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: ff68b7c0858a29420441f28f6c995f5c9b25cd2dd290d50e703ddae12fc09fa7
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: D831BE316007069BDB718F24C88ABE67FE4FB05721F18892AF55687551D374F888CB91

Function 005B6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 005B6E19

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 5186ca2aa4b4f8e0aef87278900366842e92cc942163dc64239ec8e6e7596969
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: D6211A7A204219BFDB119BA0EC4AEDF7FADFB49761B208425F502E1091EB74EA409774

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 005B92CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 005B92E2
wsprintfA.USER32 ref: 005B9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 005B9375
lstrlen.KERNEL32(?,?,00000000), ref: 005B9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 005B9394
CloseHandle.KERNEL32(00000000), ref: 005B939B

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: a15973af30e2426b72b8a6ccf6281449043aa60d7f5347fe6f74edfa959c3ee9
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 5A1184B17401157BE7216B31EC0EFEF3E6DEBC9B10F00C065BB09E5092EEB45A418664

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,774D0F10,?,00000000,0040E538,?,774D0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 005BC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 005BC6B4
InterlockedIncrement.KERNEL32(005BC74B), ref: 005BC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,005BC747), ref: 005BC728
CloseHandle.KERNEL32(00000000,?,005BC747,00413588,005B8A77), ref: 005BC733

Strings

localcfg, xrefs: 005BC544

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: aedb262e2e7370551d3fa661986246b8b46dc6062c0519030d02f829176f324c
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 4C5139B1A01B418FD7348F69C6C566ABFE9FB88300B50593EE18BC7A90DB74F8448B14

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,774D0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,774D0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,774D0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,774D0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,774D0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,774D0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,774D0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe
API String ID: 124786226-2154540336
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 005BE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,005BE50A,00000000,00000000,00000000,00020106,00000000,005BE50A,00000000,000000E4), ref: 005BE319
RegSetValueExA.ADVAPI32(005BE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 005BE38E
RegDeleteValueA.ADVAPI32(005BE50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D[), ref: 005BE3BF
RegCloseKey.ADVAPI32(005BE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D[,005BE50A), ref: 005BE3C8

Strings

D[, xrefs: 005BE2FC

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: D[
API String ID: 2667537340-2359138017
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: cfbbf2d8975094ffde3d5cc5a123a9e495c6eef6058608edd33b96bd1aaf2ee8
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: AF215E71A0021DBBDF209FA5EC8AEDE7FB9EF09750F048421F904E7151E271AA54D7A0

Function 005B71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005B71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 005B7228
LocalFree.KERNEL32(?,?,?), ref: 005B7286
wsprintfA.USER32 ref: 005B729D

Strings

|, xrefs: 005B721A

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: ec42ad3a012dc7a9aae02587fb5ff638a9287fb4dc821cd99e05d2db29a4e2ac
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 94312B76904109BFCB01DFA8DC49ADA7FACFF48310F148066F859DB241EB75E6488BA4

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(?), ref: 0040AD60
lstrlenA.KERNEL32(?), ref: 0040AD69
lstrcpyA.KERNEL32(?,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 1d5f752cf5e4d4e7205d8b51b4cea38d33843a7f37b29257b789d56d7c64f5a9
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: 1d5f752cf5e4d4e7205d8b51b4cea38d33843a7f37b29257b789d56d7c64f5a9
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 005BB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005BB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005BB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 005BB548
GetTimeZoneInformation.KERNEL32(?), ref: 005BB590
wsprintfA.USER32 ref: 005BB61E

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 51855e68cfb64dec9c31dc6b80fdec582979d894ab6c9d9959fdcc3305a5d358
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 725120B1D0021DAADF24DFD5D8895EEBBB9BF48304F10812AF501A6150E7F85AC9CF98

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 005B62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 005B6303
LoadLibraryA.KERNEL32(?), ref: 005B632A
GetProcAddress.KERNEL32(00000000,?), ref: 005B63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 005B6405

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 244c9f8f9407203e404dd9dc9a6d129699ff1fcc6eeb6bf9e454d653f1993791
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 32413871A0060AABDB14CF58C884BE9BBF8FF04354F288969E915D7290E779FD41DB50

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981fb48902faec8b3b60e951c7ac5498972a27d8d4857947259acf027c15d2af
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 981fb48902faec8b3b60e951c7ac5498972a27d8d4857947259acf027c15d2af
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(774D0F18,00000000,?,774D0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,774D0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,774D0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 005B93AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005B93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 005B93CD
CharToOemA.USER32(?,?), ref: 005B93DB
wsprintfA.USER32 ref: 005B9410

Part of subcall function 005B92CB: GetTempPathA.KERNEL32(00000400,?), ref: 005B92E2
Part of subcall function 005B92CB: wsprintfA.USER32 ref: 005B9350
Part of subcall function 005B92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 005B9375
Part of subcall function 005B92CB: lstrlen.KERNEL32(?,?,00000000), ref: 005B9389
Part of subcall function 005B92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 005B9394
Part of subcall function 005B92CB: CloseHandle.KERNEL32(00000000), ref: 005B939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 005B9448

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: a649f1f662ebe8d6f6505cc70b9d2f1a46d565ee25da5a01ba5ac056efeae30a
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: D00152F69001197BDB21A7619D4DEDF7B7CEB95701F0040A1BB49E2080EAB497C58F75

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 005B28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 005B28FA
gethostbyname.WS2_32(u6A), ref: 005B2906

Strings

u6A, xrefs: 005B28EC, 005B28F9, 005B2905
time_cfg, xrefs: 005B28EB

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 1d2a3b7c6f7ea271edeedc5c650fa9ee238e1258503c15c784c4f3b7ef5b90ca
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 47E0C2306086119FCB008B2CF848AC53BE4FF0A330F008580F044C31A1C734ECC097A0

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: a7fe28dd04f73a45cf24fffff85a70117338552789dad14eeac3c005c8f16141
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: a7fe28dd04f73a45cf24fffff85a70117338552789dad14eeac3c005c8f16141
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 005B417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 005B41AB
GetLastError.KERNEL32 ref: 005B41B5
WaitForSingleObject.KERNEL32(?,?), ref: 005B41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 005B41D9

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 71a513bc9d4f550f422177c31ae1f0961c702b94fb57f211578ab1e4c3859c50
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: F601257691110AABDF11DF94ED84BEE3BACFB18355F008061F901E2050D770AAA0CFB6

Function 005B41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 005B421F
GetLastError.KERNEL32 ref: 005B4229
WaitForSingleObject.KERNEL32(?,?), ref: 005B423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 005B424D

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 89fa91474549ebfbe92448765db2b2dc538463015d1cadd30634eeeee98de609
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: D301A272911209ABDF11DF90EE84BEEBBACFB08356F108461F901E2051D770AA549FB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 005BE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 005BE066

Strings

A, xrefs: 005BE036
A, xrefs: 005BE07F
A, xrefs: 005BE037, 005BE03C

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 32fa88398adad9b48caca3218c343102593f141e6326b2488853441698da23f0
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 04F0623120070ADBCB20DF25D888AD2BBF9FB05321B48862AE155C3060D3B4B899CB51

Function 0041A5C0 Relevance: 6.0, APIs: 4, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,00000000,00000000,00000000,0041B03C,0041A971), ref: 0041A5DC
FreeEnvironmentStringsW.KERNEL32(00000000,00000000,0041B03C,0041A971), ref: 0041A5F7
RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 0041A61A
GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 0041A622

Memory Dump Source

Source File: 00000010.00000002.1400747790.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_415000_jhrsuqtz.jbxd

Similarity

API ID: AllocateDeviceEnvironmentFreeHeapHighestNodeNumaNumberQueryStrings
String ID:
API String ID: 975556166-0
Opcode ID: fc213b24a92c472580c126cfe80f9bbfcf6dd46c5811944ea437593e0904f25d
Instruction ID: 494602ce712dfe78f3d2314fcb4a20314ccfb6bfbb70b33752429d16c64ce78c
Opcode Fuzzy Hash: fc213b24a92c472580c126cfe80f9bbfcf6dd46c5811944ea437593e0904f25d
Instruction Fuzzy Hash: 9AF08235785214ABEA30A764EC4AF963764E71C71AF908032F629962E0C7E419818B5E

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 005BE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,D[,00000000,00000000,00000000), ref: 005BE470
CloseHandle.KERNEL32(00000001,00000003), ref: 005BE484

Part of subcall function 005BE2FC: RegCreateKeyExA.ADVAPI32(80000001,005BE50A,00000000,00000000,00000000,00020106,00000000,005BE50A,00000000,000000E4), ref: 005BE319
Part of subcall function 005BE2FC: RegSetValueExA.ADVAPI32(005BE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 005BE38E
Part of subcall function 005BE2FC: RegDeleteValueA.ADVAPI32(005BE50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D[), ref: 005BE3BF
Part of subcall function 005BE2FC: RegCloseKey.ADVAPI32(005BE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,D[,005BE50A), ref: 005BE3C8

Strings

D[, xrefs: 005BE498, 005BE4BD, 005BE41A, 005BE447, 005BE4C0, 005BE41D, 005BE459, 005BE45A, 005BE46C, 005BE49B

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: D[
API String ID: 4151426672-2359138017
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: e7b139525f47d4122370ed4cdab8c198bab3c590943177ea5f98603f6bf4bc94
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 3741D871900209BAEF206B518C4BFEF3F6CFF45724F188125FA0994192E7B5AA50D6B4

Function 005B8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 005B83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 005B8477

Part of subcall function 005BEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,005B1DCF,?), ref: 005BEEA8
Part of subcall function 005BEE95: HeapFree.KERNEL32(00000000), ref: 005BEEAF

Strings

C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 005B848C, 005B84A1

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Heap$CloseFreeOpenProcess
String ID: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe
API String ID: 1016092768-2154540336
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 4fde68677851f346d0ac9e6e31f845047615bb0000dbbd6e190803eee9daccd7
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 3C415EB290110ABFEF10ABA49E85DFF7F6CFB44344F1444A6F504D6151EAB0AA98CB64

Function 005BAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005BAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 005BB00D

Part of subcall function 005BAF6F: gethostname.WS2_32(?,00000080), ref: 005BAF83
Part of subcall function 005BAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 005BAFE6

Part of subcall function 005B331C: gethostname.WS2_32(?,00000080), ref: 005B333F
Part of subcall function 005B331C: gethostbyname.WS2_32(?), ref: 005B3349

Part of subcall function 005BAA0A: inet_ntoa.WS2_32(00000000), ref: 005BAA10

Strings

%OUTLOOK_BND_, xrefs: 005BB076, 005BB07B, 005BB0BE, 005BB0DD

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: cffc76938d55058688b739609c2c9fc1989a3ad57ed5b4644cf84f2717e1c001
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: D841347290020DABDB25EFA4DC4AEEF3B6CFF44304F244426F92592152EB75E654CB54

Function 005B9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 005B9536
Sleep.KERNEL32(000001F4), ref: 005B955D

Strings

, xrefs: 005B94D9

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 2c6a29b9ec20eac2be6a51fd3bc754db56fe2b9f19993fdac4610d933dfc8ee2
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: A94113B18483896EEF378B64D89DBF67FA4BF02310F2840A5D282971E2D6B46D81C711

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 005BBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 005BB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 005BBA3A
InterlockedIncrement.KERNEL32(?), ref: 005BBA94
GetTickCount.KERNEL32 ref: 005BBB79
GetTickCount.KERNEL32 ref: 005BBB99
InterlockedIncrement.KERNEL32(?), ref: 005BBE15
closesocket.WS2_32(00000000), ref: 005BBEB4

Strings

%FROM_EMAIL, xrefs: 005BBC7D

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: f99357b01152afd8dd30bcf1fb55a9fedeef62fceb0ce0c55062fdd22bfc890c
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: CA317F71500248DFEF25DFA4DC89AED7BB8FB48700F204456FA2482161EBB5EA85CF15

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 005B709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 005B70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 005B70F4

Strings

|, xrefs: 005B70E6

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 500690029221fec0aa2aaa6f32a621cb7719f34c80e5c555977c6ef947bb9ff9
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: D8110C7290411CEBDF11CFD8DC84ADEBBBDBB48711F1441A6E501E6190D670AB88DBB0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7597EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 005B3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005B2F88: GetModuleHandleA.KERNEL32(?), ref: 005B2FA1
Part of subcall function 005B2F88: LoadLibraryA.KERNEL32(?), ref: 005B2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 005B31DA
HeapFree.KERNEL32(00000000), ref: 005B31E1

Memory Dump Source

Source File: 00000010.00000002.1400927151.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5b0000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: ebfe1ce20004df77394db66accf9abefb5a786ca771e7d639e4cf4ba51f20144
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 04518E7590024AEFCB019F68DC889FABB75FF15304F144569EC9697211E732AA19CB90

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,774D23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000010.00000002.1400719293.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_jhrsuqtz.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: ddc1366e71bb2e66961e885791bb3d9f2ae4384e5350e4f1bce6563879376d33
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: ddc1366e71bb2e66961e885791bb3d9f2ae4384e5350e4f1bce6563879376d33
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: svchost.exePID: 8172, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1803
Total number of Limit Nodes:	18

Executed Functions

Function 02EDC913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02EDCA4E
closesocket.WS2_32(?), ref: 02EDCB63
GetTempPathA.KERNEL32(00000120,?), ref: 02EDCC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02EDCCB4
WriteFile.KERNEL32(02EDA4B3,?,-000000E8,?,00000000), ref: 02EDCCDC
CloseHandle.KERNEL32(02EDA4B3), ref: 02EDCCED
wsprintfA.USER32 ref: 02EDCD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02EDCD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 02EDCD89
CloseHandle.KERNEL32(?), ref: 02EDCD98
CloseHandle.KERNEL32(?), ref: 02EDCD9D
DeleteFileA.KERNEL32(?), ref: 02EDCDC4
CloseHandle.KERNEL32(02EDA4B3), ref: 02EDCDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02EDCFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02EDCFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02EDD033
lstrcatA.KERNEL32(?,04500108), ref: 02EDD10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 02EDD155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 02EDD171
WriteFile.KERNEL32(00000000,0450012C,?,?,00000000), ref: 02EDD195
CloseHandle.KERNEL32(00000000), ref: 02EDD19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 02EDD1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02EDD231
lstrcatA.KERNEL32(?,04500108,?,?,?,?,?,?,?,00000100), ref: 02EDD27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02EDD2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02EDD2C7
WriteFile.KERNEL32(00000000,0450012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02EDD2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02EDD2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02EDD326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02EDD372
lstrcatA.KERNEL32(?,04500108,?,?,?,?,?,?,?,00000100), ref: 02EDD3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02EDD3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02EDD408
WriteFile.KERNEL32(00000000,0450012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02EDD428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02EDD42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02EDD45B
CreateProcessA.KERNEL32(?,02EE0264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02EDD4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02EDD4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02EDD4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02EDD513
closesocket.WS2_32(?), ref: 02EDD56C
Sleep.KERNEL32(000003E8), ref: 02EDD577
ExitProcess.KERNEL32 ref: 02EDD583
wsprintfA.USER32 ref: 02EDD81F

Part of subcall function 02EDC65C: send.WS2_32(00000000,?,00000000), ref: 02EDC74B

closesocket.WS2_32(?), ref: 02EDDAD5

Strings

wtm_r, xrefs: 02EDC97F
C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 02EDCC10, 02EDCCF3, 02EDD975, 02EDD98E
.sys, xrefs: 02EDD0CC
@, xrefs: 02EDD754
drivers\, xrefs: 02EDD067
localcfg, xrefs: 02EDCA89, 02EDCA93, 02EDCAC0, 02EDCAD2, 02EDCE4F, 02EDCE6F, 02EDD8D3, 02EDD8FC
except_info, xrefs: 02EDD8CD, 02EDD8D2, 02EDD8FB
lid_file_upd, xrefs: 02EDCE6A
work_srv, xrefs: 02EDD607, 02EDD60F, 02EDD62C
time_cfg, xrefs: 02EDC95B, 02EDC962, 02EDC971, 02EDC984
\, xrefs: 02EDD3A7
flags_upd, xrefs: 02EDCE4A
4, xrefs: 02EDD9F7
local_time, xrefs: 02EDCACD
wtm_w, xrefs: 02EDC96C
\, xrefs: 02EDD39D
.dat, xrefs: 02EDD0D7, 02EDD138, 02EDD1AE, 02EDD1D4, 02EDD28E, 02EDD308, 02EDD3CF, 02EDD441
srv_time, xrefs: 02EDCABB
wtm_c, xrefs: 02EDC956

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-1236896550
Opcode ID: 129e9ad947de29bf4d34f1a778f05bfa95c2b515505cb40a70351054d174e2c3
Instruction ID: c60d5686d5cc71c62c29150bfc4eb106a7414384bb054070aee9b78f6949107e
Opcode Fuzzy Hash: 129e9ad947de29bf4d34f1a778f05bfa95c2b515505cb40a70351054d174e2c3
Instruction Fuzzy Hash: 89B294B2DC0209ABEF20DFA5DC44FEA77ADEB04348F54A496F605AB140D7709996CF60

Function 02ED9A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 02ED9A7F
SetErrorMode.KERNELBASE(00000003), ref: 02ED9A83
SetUnhandledExceptionFilter.KERNEL32(02ED6511), ref: 02ED9A8A

Part of subcall function 02EDEC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 02EDEC5E
Part of subcall function 02EDEC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02EDEC72
Part of subcall function 02EDEC54: GetTickCount.KERNEL32 ref: 02EDEC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 02ED9AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 02ED9ABA
GetCommandLineA.KERNEL32 ref: 02ED9AFD
lstrlenA.KERNEL32(?), ref: 02ED9B99
ExitProcess.KERNEL32 ref: 02ED9C06
GetTempPathA.KERNEL32(000001F4,?), ref: 02ED9CAC
lstrcpyA.KERNEL32(?,00000000), ref: 02ED9D7A
lstrcatA.KERNEL32(?,?), ref: 02ED9D8B
lstrcatA.KERNEL32(?,02EE070C), ref: 02ED9D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02ED9DED
DeleteFileA.KERNEL32(00000022), ref: 02ED9E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02ED9E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02ED9EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02ED9ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 02ED9F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 02ED9F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02ED9F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 02ED9FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02ED9FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02ED9FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 02EDA038
lstrcatA.KERNEL32(00000022,02EE0A34), ref: 02EDA05E
lstrcatA.KERNEL32(00000022,00000022), ref: 02EDA072
lstrcatA.KERNEL32(00000022,02EE0A34), ref: 02EDA08D
wsprintfA.USER32 ref: 02EDA0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 02EDA0DE
lstrcatA.KERNEL32(00000022,?), ref: 02EDA0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 02EDA120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02EDA131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 02EDA174
GetModuleFileNameA.KERNEL32(00000000), ref: 02EDA17B
GetDriveTypeA.KERNEL32(00000022), ref: 02EDA1B6
GetCommandLineA.KERNEL32 ref: 02EDA1E5

Part of subcall function 02ED99D2: lstrcpyA.KERNEL32(?,?,00000100,02EE22F8,00000000,?,02ED9E9D,?,00000022,?,?,?,?,?,?,?), ref: 02ED99DF
Part of subcall function 02ED99D2: lstrcatA.KERNEL32(00000022,00000000,?,?,02ED9E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 02ED9A3C
Part of subcall function 02ED99D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,02ED9E9D,?,00000022,?,?,?), ref: 02ED9A52

lstrlenA.KERNEL32(?), ref: 02EDA288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 02EDA3B7
GetLastError.KERNEL32 ref: 02EDA3ED
Sleep.KERNEL32(000003E8), ref: 02EDA400
DeleteFileA.KERNELBASE(02EE33D8), ref: 02EDA407
CreateThread.KERNELBASE(00000000,00000000,02ED405E,00000000,00000000,00000000), ref: 02EDA42C
WSAStartup.WS2_32(00001010,?), ref: 02EDA43A
CreateThread.KERNELBASE(00000000,00000000,02ED877E,00000000,00000000,00000000), ref: 02EDA469
Sleep.KERNELBASE(00000BB8), ref: 02EDA48A
GetTickCount.KERNEL32 ref: 02EDA49F
GetTickCount.KERNEL32 ref: 02EDA4B7
Sleep.KERNELBASE(00001A90), ref: 02EDA4C3

Strings

", xrefs: 02EDA078
", xrefs: 02EDA189
C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 02EDA1D9
%X%08X, xrefs: 02EDA0B0
", xrefs: 02ED9EDB
\, xrefs: 02ED9D0C
D, xrefs: 02ED9F8E
puwycifc, xrefs: 02EDA389, 02EDA397
P, xrefs: 02ED9DAA

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe$D$P$\$puwycifc
API String ID: 2089075347-2159763429
Opcode ID: afd5c36e4d88cbf2a83dd3a3cc6cc62b56d1603d625d837ce03d73b970b314cc
Instruction ID: 82843247f86e89df8e7ffa1cf9de4856b2a0fbc8392fc22fefe9c343b6bea9aa
Opcode Fuzzy Hash: afd5c36e4d88cbf2a83dd3a3cc6cc62b56d1603d625d837ce03d73b970b314cc
Instruction Fuzzy Hash: 325281B1CC0259EFDF21DBB0DC49EEE7BBDAB04304F4498A5F509A6141E7709A868F61

Function 02ED199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 02ED19B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,02ED1E9E), ref: 02ED19BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02ED19E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 02ED19ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 02ED19F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,02ED1E9E), ref: 02ED1A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,02ED1E9E), ref: 02ED1A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,02ED1E9E), ref: 02ED1A36
GetAdaptersInfo.IPHLPAPI(00000000,02ED1E9E,?,?,?,?,00000001,02ED1E9E), ref: 02ED1A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,02ED1E9E,?,?,?,?,00000001,02ED1E9E), ref: 02ED1A5A
GetAdaptersInfo.IPHLPAPI(00000000,02ED1E9E,?,?,?,?,00000001,02ED1E9E), ref: 02ED1A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,02ED1E9E), ref: 02ED1A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,02ED1E9E), ref: 02ED1AA4

Strings

Iphlpapi.dll, xrefs: 02ED19B7
localcfg, xrefs: 02ED19A3
123.45.67.89, xrefs: 02ED19A6
GetAdaptersInfo, xrefs: 02ED19DC
GetIfEntry, xrefs: 02ED19E4
GetBestInterface, xrefs: 02ED19EF

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 577ad0a16a693c95d205d22d02c5b7dbbdb4cbfcdbc35a002ebaa16f1a95b377
Instruction ID: fd648f4b4b1b305f84524f34b883976c7b6bd073e8482048be79692fb5a35033
Opcode Fuzzy Hash: 577ad0a16a693c95d205d22d02c5b7dbbdb4cbfcdbc35a002ebaa16f1a95b377
Instruction Fuzzy Hash: 58318131D80219EFDF119FE1CD888BEBBB9EF44245B549569F10ABB100D7704A41CB60

Function 02ED7A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 02ED7ABA
GetUserNameA.ADVAPI32(?,?), ref: 02ED7ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,02EE070C,?,?,?), ref: 02ED7B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 02ED7B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 02ED7B59
EqualSid.ADVAPI32(?,00000022), ref: 02ED7B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 02ED7B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02ED7B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02ED7B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 02ED7BAB
LocalFree.KERNEL32(00000000), ref: 02ED7BB2
GetSecurityDescriptorDacl.ADVAPI32(?,02ED7FC9,?,00000000), ref: 02ED7BCE

Strings

C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 02ED7CE2, 02ED7D0F, 02ED7D23, 02ED7D24
D, xrefs: 02ED7B0C

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe$D
API String ID: 2976863881-3064012573
Opcode ID: aa90c8e6d9238ff78acd9c73e6a7b833637792532e50fa07f293f915bf18a44d
Instruction ID: ca5a748387ed6baef8edc4c4775bec3d8f12a9e1ab325309f79681f2a191b70c
Opcode Fuzzy Hash: aa90c8e6d9238ff78acd9c73e6a7b833637792532e50fa07f293f915bf18a44d
Instruction Fuzzy Hash: 4FA14D71D80219EFDF119FA1DC84EEEBBB9FB09308F049869F505E6140D7758A96CB60

Function 02ED7809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02ED782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02ED7866
GetLengthSid.ADVAPI32(?), ref: 02ED7878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02ED789A
GetSecurityDescriptorOwner.ADVAPI32(?,02ED7F63,?), ref: 02ED78B8
EqualSid.ADVAPI32(?,02ED7F63), ref: 02ED78D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 02ED78E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02ED78F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02ED7901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02ED7910
LocalFree.KERNEL32(00000000), ref: 02ED7917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02ED7933
GetAce.ADVAPI32(?,00000000,?), ref: 02ED7963
EqualSid.ADVAPI32(?,02ED7F63), ref: 02ED798A
DeleteAce.ADVAPI32(?,00000000), ref: 02ED79A3
EqualSid.ADVAPI32(?,02ED7F63), ref: 02ED79C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 02ED7A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02ED7A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02ED7A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02ED7A79
LocalFree.KERNEL32(00000000), ref: 02ED7A87

Strings

D, xrefs: 02ED785C

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 2a613b13e076cbded5807dfe268743edde2b9150cd5b50b5d6eb90d863335c2f
Instruction ID: 63db7ce30b77cb0834951a77377beb69441c87eccae1098b52809cbccab00b43
Opcode Fuzzy Hash: 2a613b13e076cbded5807dfe268743edde2b9150cd5b50b5d6eb90d863335c2f
Instruction Fuzzy Hash: 8E813972D80219EFDF21CFA5CD44BEEBBB8EB08348F54956AF515EA140D7348A42CB60

Function 02ED8328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,02EE0750,?,?,00000000,localcfg,00000000), ref: 02ED83F3
RegQueryValueExA.KERNELBASE(02EE0750,?,00000000,?,02ED8893,?,?,?,00000000,00000103,02EE0750,?,?,00000000,localcfg,00000000), ref: 02ED8414
RegSetValueExA.KERNELBASE(02EE0750,?,00000000,00000004,02ED8893,00000004,?,?,00000000,00000103,02EE0750,?,?,00000000,localcfg,00000000), ref: 02ED8441
RegCloseKey.ADVAPI32(02EE0750,?,?,00000000,00000103,02EE0750,?,?,00000000,localcfg,00000000), ref: 02ED844A

Strings

C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 02ED85C8, 02ED85D5, 02ED85E5
localcfg, xrefs: 02ED8348

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe$localcfg
API String ID: 237177642-3136575136
Opcode ID: c61b0404beb30a2c55fdaf8ed85ebd5e204af003bb423b9ec5764ef0ae35e13d
Instruction ID: 1f0c378b97a1f3573da573d42d58ca1bdd6ec881fb0b174debe877682dd6d5ed
Opcode Fuzzy Hash: c61b0404beb30a2c55fdaf8ed85ebd5e204af003bb423b9ec5764ef0ae35e13d
Instruction Fuzzy Hash: 8DC17EB1DC0149FEEF11EFA5DC85EEE7BBDEB04308F149865FA05A6040E7705A968B21

Function 02ED1D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 02ED1DC6
GetSystemInfo.KERNELBASE(?), ref: 02ED1DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 02ED1E03
GetProcAddress.KERNEL32(00000000), ref: 02ED1E0A
GetCurrentProcess.KERNEL32(?), ref: 02ED1E1B
GetTickCount.KERNEL32 ref: 02ED1FC9

Part of subcall function 02ED1BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 02ED1C15

Strings

born_date, xrefs: 02ED1EAD, 02ED1ECC
start_srv, xrefs: 02ED1E6C
localcfg, xrefs: 02ED1E2A, 02ED1E31, 02ED1E44, 02ED1E7D, 02ED1E8C, 02ED1EB2, 02ED1ED1, 02ED1EE7, 02ED1EFF, 02ED1F1C, 02ED1F34, 02ED1F50, 02ED1F70
lid_file_upd, xrefs: 02ED1E25
IsWow64Process, xrefs: 02ED1DF2
kernel32, xrefs: 02ED1DF7
work_srv, xrefs: 02ED1E5E
loader_id, xrefs: 02ED1F4B, 02ED1F6B
net_type, xrefs: 02ED1E87
hi_id, xrefs: 02ED1F16, 02ED1F1B, 02ED1F33
flags_upd, xrefs: 02ED1E3E, 02ED1E43, 02ED1E7C

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 010b13180c399675cdc480262b1acefc54d1d323d9e57f753a12ebeabf73f441
Instruction ID: 96939d6d63ed7c9c800f3ac9e2fcb1386167cdb76a7d1fef2b8f0a768ef4ab1d
Opcode Fuzzy Hash: 010b13180c399675cdc480262b1acefc54d1d323d9e57f753a12ebeabf73f441
Instruction Fuzzy Hash: A251E8B09C4344AFE720AF768C89F277BECEF44708F44A91DF58A5A142D7B4A505CBA1

Function 02ED73FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,774D0F10,00000000), ref: 02ED7472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,774D0F10,00000000), ref: 02ED74F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,774D0F10,00000000), ref: 02ED7528
___ascii_stricmp.LIBCMT ref: 02ED764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,774D0F10,00000000), ref: 02ED76E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 02ED7706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,774D0F10,00000000), ref: 02ED7717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,774D0F10,00000000), ref: 02ED7745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,774D0F10,00000000), ref: 02ED77EF

Part of subcall function 02EDF1A5: lstrlenA.KERNEL32(000000C8,000000E4,02EE22F8,000000C8,02ED7150,?), ref: 02EDF1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02ED778F
RegCloseKey.KERNELBASE(?), ref: 02ED77E6

Strings

", xrefs: 02ED7599

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: e89f6b73ecc02c9bf42d6560c7deb16c7012492cad64fdfb9ea285db35c74b8e
Instruction ID: 2fef0f725fb854a6f15e3b59f342c455679e7cf3b8b258cadc53cd01444bb6fe
Opcode Fuzzy Hash: e89f6b73ecc02c9bf42d6560c7deb16c7012492cad64fdfb9ea285db35c74b8e
Instruction Fuzzy Hash: D6C1C271980209AFEB11DBA5DC48FEEBBB9EF44314F149495F504AA190EB70DA82CF60

Function 02ED675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,774D0F10,00000000), ref: 02ED677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,774D0F10,00000000), ref: 02ED679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,774D0F10,00000000), ref: 02ED67B0
SetFileAttributesA.KERNEL32(?,00000002,?,774D0F10,00000000), ref: 02ED67BF
GetFileSize.KERNEL32(000000FF,00000000,?,774D0F10,00000000), ref: 02ED67D3
ReadFile.KERNELBASE(000000FF,?,00000040,02ED8244,00000000,?,774D0F10,00000000), ref: 02ED6807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 02ED681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,774D0F10,00000000), ref: 02ED683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 02ED685C
ReadFile.KERNEL32(000000FF,?,00000028,02ED8244,00000000,?,774D0F10,00000000), ref: 02ED688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,774D0F10,00000000), ref: 02ED6906
ReadFile.KERNEL32(000000FF,?,00000000,02ED8244,00000000,?,774D0F10,00000000), ref: 02ED691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,774D0F10,00000000), ref: 02ED6971

Part of subcall function 02EDEC2E: GetProcessHeap.KERNEL32(00000000,02EDEA27,00000000,02EDEA27,00000000), ref: 02EDEC41
Part of subcall function 02EDEC2E: RtlFreeHeap.NTDLL(00000000), ref: 02EDEC48

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 8efe3f6e2984617b46ae42338e6defa90681f0a99064ea3151a195b37b03e12c
Instruction ID: c4a4f2b833cb4e9034622f92e12558f956a8ffa0e05c85a42b4a8567fdb964d4
Opcode Fuzzy Hash: 8efe3f6e2984617b46ae42338e6defa90681f0a99064ea3151a195b37b03e12c
Instruction Fuzzy Hash: 5F712AB1C8021DEFDF148FA5DC80AEEBBB9FB04318F10956AE515A6190D7309E92DF60

Function 02EDF315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(02EDCA1D), ref: 02EDF34D
socket.WS2_32(00000002,00000001,00000000), ref: 02EDF367
closesocket.WS2_32(00000000), ref: 02EDF375

Strings

time_cfg, xrefs: 02EDF323

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 1a2548509997d6d443206cb9a17784b79746b4e519c073907b36a17c5c2e6740
Instruction ID: 051475fd8c1e640b24faa7953dce9a9582ed1366186676879c23f15e7b9c8908
Opcode Fuzzy Hash: 1a2548509997d6d443206cb9a17784b79746b4e519c073907b36a17c5c2e6740
Instruction Fuzzy Hash: 11317E72980118ABDB10DFA5DC849EE7BFCFF49314F108566F919E7141E7709A828BA0

Function 02ED405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02ED4070
ExitProcess.KERNEL32 ref: 02ED4121

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 01693e7b361ccb41a0229e685d922e3116cd0d1c59c79583a28ec18b89fb9c96
Instruction ID: fbdddf89ff7002766e0635bd5e4872cda900e3c91889977a9287cf850e5235da
Opcode Fuzzy Hash: 01693e7b361ccb41a0229e685d922e3116cd0d1c59c79583a28ec18b89fb9c96
Instruction Fuzzy Hash: EB5161B1DC0219BADF10ABA18D85FEF7B7DEB25718F409455F614BA0C0E7718A42CB61

Function 02ED2D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,774D23A0,?,00000000,02ED2F01,?,02ED20FF,02EE2000), ref: 02ED2D3A
LoadLibraryA.KERNEL32(?), ref: 02ED2D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02ED2D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 02ED2D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 02ED2D99
HeapAlloc.KERNEL32(00000000), ref: 02ED2DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 02ED2DCB

Strings

dnsapi.dll, xrefs: 02ED2D29
DnsQuery_A, xrefs: 02ED2D5B

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: 26d6e17006b9935d74c0d34c6551e2de1ba19f55cf744b4f4cb263542c9cb614
Instruction ID: 83c135ba216d4f7a703c55c5b9b450538cfd6d8e7faf37ebfc6783a6e52704cc
Opcode Fuzzy Hash: 26d6e17006b9935d74c0d34c6551e2de1ba19f55cf744b4f4cb263542c9cb614
Instruction Fuzzy Hash: D7218171980225EBCB219FA5DC44AAEBBB8EF09754F408412FA45F7101D3B099828BE0

Function 02ED80C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 02ED815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,02EDA45F,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 02ED8187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,02EDA45F,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 02ED81BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,774D0F10,00000000), ref: 02ED8210

Part of subcall function 02ED675C: SetFileAttributesA.KERNEL32(?,00000080,?,774D0F10,00000000), ref: 02ED677E
Part of subcall function 02ED675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,774D0F10,00000000), ref: 02ED679A
Part of subcall function 02ED675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,774D0F10,00000000), ref: 02ED67B0
Part of subcall function 02ED675C: SetFileAttributesA.KERNEL32(?,00000002,?,774D0F10,00000000), ref: 02ED67BF
Part of subcall function 02ED675C: GetFileSize.KERNEL32(000000FF,00000000,?,774D0F10,00000000), ref: 02ED67D3
Part of subcall function 02ED675C: ReadFile.KERNELBASE(000000FF,?,00000040,02ED8244,00000000,?,774D0F10,00000000), ref: 02ED6807
Part of subcall function 02ED675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 02ED681F
Part of subcall function 02ED675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,774D0F10,00000000), ref: 02ED683E
Part of subcall function 02ED675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,774D0F10,00000000), ref: 02ED685C

Part of subcall function 02EDEC2E: GetProcessHeap.KERNEL32(00000000,02EDEA27,00000000,02EDEA27,00000000), ref: 02EDEC41
Part of subcall function 02EDEC2E: RtlFreeHeap.NTDLL(00000000), ref: 02EDEC48

Strings

C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe, xrefs: 02ED8225, 02ED823A

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe
API String ID: 124786226-2154540336
Opcode ID: 3f8c7d4cef236f23182fa96068e2445fd1b682867eb466efcb121a0616df7461
Instruction ID: 04487ff46514fd8aaf2e9d992a0d33fae5d6e04f91e39556d97bf975fd6eef1f
Opcode Fuzzy Hash: 3f8c7d4cef236f23182fa96068e2445fd1b682867eb466efcb121a0616df7461
Instruction Fuzzy Hash: 3A4152B2DC1109BFEF11EFA1ED85EFE776D9B04308F449866FA05A6000E7705E968B61

Function 02ED1AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02ED1AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02ED1AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02ED1B20

Strings

GetAdaptersAddresses, xrefs: 02ED1AE3
Iphlpapi.dll, xrefs: 02ED1ACC

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 1330725c42edbc00d2b17720e155165350822051bc8b6ad23e0139177efd7aa4
Instruction ID: 900794c603d89f09e80fac2543baa918e6a56647b576a80ccb6395007739ea86
Opcode Fuzzy Hash: 1330725c42edbc00d2b17720e155165350822051bc8b6ad23e0139177efd7aa4
Instruction Fuzzy Hash: 17110671E81128EFDF218BA9CC948EDBBBAEB44B54B14D055F00EAF101E7704A42CB90

Function 02EDE3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,02EDE5F2,00000000,00020119,02EDE5F2,02EE22F8), ref: 02EDE3E6
RegQueryValueExA.ADVAPI32(02EDE5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 02EDE44E
RegQueryValueExA.ADVAPI32(02EDE5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 02EDE482
RegQueryValueExA.ADVAPI32(02EDE5F2,?,00000000,?,80000001,?), ref: 02EDE4CF
RegCloseKey.ADVAPI32(02EDE5F2,?,?,?,?,000000C8,000000E4), ref: 02EDE520

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 9cd8ba3f529affbbac1d8b7b96a6e087b56a57dd6ce72c73c1e8b7cc01526a1a
Instruction ID: 2b8a32e48dc80e28b5630e90bd02029833b0cc600807e4ef3cad58d94ae8320c
Opcode Fuzzy Hash: 9cd8ba3f529affbbac1d8b7b96a6e087b56a57dd6ce72c73c1e8b7cc01526a1a
Instruction Fuzzy Hash: 424107B2D80219EFDF11DFE4DC84DEEBBBAEB08344F549466F910A6150E3319A568B60

Function 02EDF26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 02EDF2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 02EDF2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 02EDF2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 02EDF2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02EDF2FD

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 382af35e3df1b8112510c4c24e7cc706cc6583964d57b3a8aa5f4b8e73bdb0f0
Instruction ID: 685bed17fc9d84a5d2bd47717bdfe81bf1ed536045ae98ee7010165728d35012
Opcode Fuzzy Hash: 382af35e3df1b8112510c4c24e7cc706cc6583964d57b3a8aa5f4b8e73bdb0f0
Instruction Fuzzy Hash: 5711FBB1A40248BAEF11DE95CD41F9E7FBCEB44751F004066BB04EA1D0E6B19A44CB94

Function 02ED1BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02ED1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02ED1AD4
Part of subcall function 02ED1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02ED1AE9
Part of subcall function 02ED1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02ED1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02ED1C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 02ED1C51

Strings

localcfg, xrefs: 02ED1BE7
hi_id, xrefs: 02ED1BE5

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 1dd4b61d4ff5eb6c89501d169d60c57d34c9f6d22ba8473ded723d2e35cefdcb
Instruction ID: 4971c84f978af757df546d5c4b62a8380b5f470297ec3bd6488057c9b0da3a56
Opcode Fuzzy Hash: 1dd4b61d4ff5eb6c89501d169d60c57d34c9f6d22ba8473ded723d2e35cefdcb
Instruction Fuzzy Hash: B201D2B2A80118BFEB14DAF8C8C09EFBBBCEB44248F104835E606E7140D2709E4586B0

Function 02ED1B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 02ED1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02ED1AD4
Part of subcall function 02ED1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02ED1AE9
Part of subcall function 02ED1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02ED1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02ED1BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,02ED1EFD,00000000,00000000,00000000,00000000), ref: 02ED1BB8

Strings

localcfg, xrefs: 02ED1B7B

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 8e090af8c62307a20cabe323e82ed5ca1e5c916a613f5df61efd3347723a2dbd
Instruction ID: cf6a8c16b1dc902cbd6326d2446e1081624d754d7f7ce47bb8afcf801e716a26
Opcode Fuzzy Hash: 8e090af8c62307a20cabe323e82ed5ca1e5c916a613f5df61efd3347723a2dbd
Instruction Fuzzy Hash: 9A014BB6D40108FFEB019AE9C8859EFFABDAB48654F154562A605FB140D6B05E098AB0

Function 02ED2684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 02ED2693
gethostbyname.WS2_32(00000001), ref: 02ED269F

Strings

time_cfg, xrefs: 02ED2684

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: be68f43726adaaef3cd14fb104c16a133ce254561171f15d4fb1367e0abf889c
Instruction ID: 9d4c8218ed67f21246cc04193c63c8dfdf27cb116421622a39a9b1632d74c0f0
Opcode Fuzzy Hash: be68f43726adaaef3cd14fb104c16a133ce254561171f15d4fb1367e0abf889c
Instruction Fuzzy Hash: CCE0C234A84211CFCB108F28F444BD577E5EF0A234F018580F964DB192C770DCC28780

Function 02EDE52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02EDDD05: GetTickCount.KERNEL32 ref: 02EDDD0F
Part of subcall function 02EDDD05: InterlockedExchange.KERNEL32(02EE36B4,00000001), ref: 02EDDD44
Part of subcall function 02EDDD05: GetCurrentThreadId.KERNEL32 ref: 02EDDD53

GetFileSize.KERNEL32(00000000,00000000,?,774D0F10,?,00000000,?,02EDA445), ref: 02EDE558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,774D0F10,?,00000000,?,02EDA445), ref: 02EDE583
CloseHandle.KERNEL32(00000000,?,774D0F10,?,00000000,?,02EDA445), ref: 02EDE5B2

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: d4c35ffd652bc4081109f63e8d5212f81b8fea68d720bc1145b1ad21c498335a
Instruction ID: 3f7f1600495ba6194f83e619b6abf93a0545dbc9a52e3a4ba2dd4ad4015c055c
Opcode Fuzzy Hash: d4c35ffd652bc4081109f63e8d5212f81b8fea68d720bc1145b1ad21c498335a
Instruction Fuzzy Hash: 862129B29C03047BFA207A729C1AF6B3E0DDB55754F04A954FE0EBD1C3EA61D91289B1

Function 02ED877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 02ED88A5

Part of subcall function 02EDF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02EDE342,00000000,7597EA50,80000001,00000000,02EDE513,?,00000000,00000000,?,000000E4), ref: 02EDF089
Part of subcall function 02EDF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02EDE342,00000000,7597EA50,80000001,00000000,02EDE513,?,00000000,00000000,?,000000E4,000000C8), ref: 02EDF093

Strings

localcfg, xrefs: 02ED87CA, 02ED87CF, 02ED87FB, 02ED8835, 02ED8861
rresolv, xrefs: 02ED87F6, 02ED885C

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 5182ee7fdd9881b489f337ba143ba9e7f72536173b3f38df9d22eae67f98af82
Instruction ID: 1179c3b996a3e2f12e1b18b6ecd26b2aace0a626e717eb708e8f535f289a5f06
Opcode Fuzzy Hash: 5182ee7fdd9881b489f337ba143ba9e7f72536173b3f38df9d22eae67f98af82
Instruction Fuzzy Hash: 1F21DC315C8300AAFB14FF66AC46B6A369DD700714FD4A819FF05AA0C1DFE14583C9A2

Function 02ED4000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,02EE22F8,02ED42B6,00000000,00000001,02EE22F8,00000000,?,02ED98FD), ref: 02ED4021
GetLastError.KERNEL32(?,02ED98FD,00000001,00000100,02EE22F8,02EDA3C7), ref: 02ED402C
Sleep.KERNEL32(000001F4,?,02ED98FD,00000001,00000100,02EE22F8,02EDA3C7), ref: 02ED4046

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 04d4df8550adadfb0ebb8f3190f93a10dbbaa1a61861c8b1ab333448283d2a93
Instruction ID: 48747803cf12e20516e508edc8b0b9e8c91415d27dfe4e827111439daacad1f9
Opcode Fuzzy Hash: 04d4df8550adadfb0ebb8f3190f93a10dbbaa1a61861c8b1ab333448283d2a93
Instruction Fuzzy Hash: 1AF082316C4101AADB314A25AC49B5A3261DB91728FA59E24F3B5F60D0C77044829A16

Function 02EDDB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02EDDC19,?,00000104), ref: 02EDDB7F
lstrcpyA.KERNEL32(?,02EE28F8), ref: 02EDDBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 02EDDBC2

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: 1c7fe983faa11f777644466d06c3ca6123303c3715adb0969db9d617dcf29622
Instruction ID: 1e97906e8c8c0ca5d66ad151e2492c7a597114048cd10f7a82d4b803a791e3ee
Opcode Fuzzy Hash: 1c7fe983faa11f777644466d06c3ca6123303c3715adb0969db9d617dcf29622
Instruction Fuzzy Hash: 6DF09071580209EBEF209F64DC49FD93B69AB00318F504994BB91A80D0D7F2D595CB10

Function 02EDEC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 02EDEC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02EDEC72
GetTickCount.KERNEL32 ref: 02EDEC78

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 971421b07118cec3af37e7b2eb6be9eae50ea4231c4faa52346e628b6ffd830b
Instruction ID: 44da6d5d71b9164151cb0b120058b7762e0414053b01a91f247b8f4fd88b8e2f
Opcode Fuzzy Hash: 971421b07118cec3af37e7b2eb6be9eae50ea4231c4faa52346e628b6ffd830b
Instruction Fuzzy Hash: E2E09AF5C90104FFEB01EBB1DC4AE7B77BCEB08314F900A54B911EA080DAB09A548B60

Function 02ED30B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02ED30D8
gethostbyname.WS2_32(?), ref: 02ED30E2

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: afee3e601493326e6693b2caaf11a95e99f474c6a650d36ac9368607e54a129e
Instruction ID: 03be3da248173916e071f44e553ec7461cf14da7caf98c35b8e27658900994ff
Opcode Fuzzy Hash: afee3e601493326e6693b2caaf11a95e99f474c6a650d36ac9368607e54a129e
Instruction Fuzzy Hash: 75E06571D40119ABCF009BA8EC89F9A77ECBB08208F084461F905E7241EA74E9058B90

Function 02EDEC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02EDEBA0: GetProcessHeap.KERNEL32(00000000,00000000,02EDEC0A,00000000,80000001,?,02EDDB55,7FFF0001), ref: 02EDEBAD
Part of subcall function 02EDEBA0: HeapSize.KERNEL32(00000000,?,02EDDB55,7FFF0001), ref: 02EDEBB4

GetProcessHeap.KERNEL32(00000000,02EDEA27,00000000,02EDEA27,00000000), ref: 02EDEC41
RtlFreeHeap.NTDLL(00000000), ref: 02EDEC48

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: 3525a1e2fcee461c57d7fe82a595258cdb5e038d8859a9a99032ac9aef3f0373
Instruction ID: d0ba48361fd7b6a34e11296a014e5a770bb6430aadf40133c181583eaab84baa
Opcode Fuzzy Hash: 3525a1e2fcee461c57d7fe82a595258cdb5e038d8859a9a99032ac9aef3f0373
Instruction Fuzzy Hash: 47C012328C6330EBC9612651F80CFDF6B589F45611F4D4809F4057F040D7A068814AF1

Function 02EDEBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,02EDEBFE,7FFF0001,?,02EDDB55,7FFF0001), ref: 02EDEBD3
RtlAllocateHeap.NTDLL(00000000,?,02EDDB55,7FFF0001), ref: 02EDEBDA

Part of subcall function 02EDEB74: GetProcessHeap.KERNEL32(00000000,00000000,02EDEC28,00000000,?,02EDDB55,7FFF0001), ref: 02EDEB81
Part of subcall function 02EDEB74: HeapSize.KERNEL32(00000000,?,02EDDB55,7FFF0001), ref: 02EDEB88

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: 1e739358a3a35f57637854f067c5473f8b3c26a235ab1d5f8ec3561269b3a5f8
Instruction ID: e1f41c00b834c1d11f0e9f73d99bebc644782bc83d807141d4bd98f1caa55603
Opcode Fuzzy Hash: 1e739358a3a35f57637854f067c5473f8b3c26a235ab1d5f8ec3561269b3a5f8
Instruction Fuzzy Hash: 03C01232584220E7CA1127A5B80CB9A2A94DB04252F044404F505DE150D66048918AA1

Function 02EDF43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,02EDCA44), ref: 02EDF476

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 1b45cb175dc62c3706034beed5d03bda91f04a177eec3918b572514564da69c8
Instruction ID: e6e091bac6c34562be042dd8f8c2cd0039267bbacbeacad8d6fe0b80651a5334
Opcode Fuzzy Hash: 1b45cb175dc62c3706034beed5d03bda91f04a177eec3918b572514564da69c8
Instruction Fuzzy Hash: 82F08C3264014ABB9F019E9AEC84CEB3BAEFB892147444122FA09D7110D631E8628BA0

Function 02ED1978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 02ED1992

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: ae1f2fd8d05d6bb778d897156124505e4a40adc7f0a8f3377b970b30b6350eb6
Instruction ID: efb24e70a7fd60358726c5a9a979da8c7929089b7e26659e9bcae58119b3c2c2
Opcode Fuzzy Hash: ae1f2fd8d05d6bb778d897156124505e4a40adc7f0a8f3377b970b30b6350eb6
Instruction Fuzzy Hash: ACD022322C8231AA42002319B80047FABCCDF08272700E41AFC4CC4000C730C8828791

Function 02EDDD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 02EDDDB5

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: e7380156ee375a439c45d376d622c89e054ab6b618221561345dc85d1d714fd5
Instruction ID: 1ab4a91a30633ca2b0c265eab29a0725ed1789c97b0d94255f2ce8f1fbabfaac
Opcode Fuzzy Hash: e7380156ee375a439c45d376d622c89e054ab6b618221561345dc85d1d714fd5
Instruction Fuzzy Hash: 49F01233684202CBCF20CE699C44656B7E8EB4B22DF159E2EE655D2180DB31D856CB61

Non-executed Functions

Function 02ED637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02ED9816,EntryPoint), ref: 02ED638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,02ED9816,EntryPoint), ref: 02ED63A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02ED63CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02ED63EB

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 9f922dd8eb74f60cb2091eb78dc3f2cf4f07d5875064521ba8f7fc2c94079d63
Instruction ID: fc9a90564717b214f5f583def93e213da4b7e71f4a2a0a42cc3d87576c4707d7
Opcode Fuzzy Hash: 9f922dd8eb74f60cb2091eb78dc3f2cf4f07d5875064521ba8f7fc2c94079d63
Instruction Fuzzy Hash: E1117771A80219BFDB119F65EC49F9B3BACEB447A9F118424F919EB240D771DC118AB0

Function 02ED1000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,02ED1839,02ED9646), ref: 02ED1012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 02ED10C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 02ED10E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 02ED1101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 02ED1121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 02ED1140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 02ED1160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 02ED1180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 02ED119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 02ED11BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 02ED11DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 02ED11FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 02ED121A

Strings

RtlLengthSid, xrefs: 02ED1246
RtlAllocateAndInitializeSid, xrefs: 02ED120F
NtOpenProcessToken, xrefs: 02ED11D4
NtFilterToken, xrefs: 02ED122B
RtlNtStatusToDosError, xrefs: 02ED1194
NtSetInformationToken, xrefs: 02ED1175
RtlExpandEnvironmentStrings_U, xrefs: 02ED10BC
RtlFreeSid, xrefs: 02ED1116
NtTerminateProcess, xrefs: 02ED10F6
NtSetInformationThread, xrefs: 02ED1155
NtDuplicateToken, xrefs: 02ED11F3
NtClose, xrefs: 02ED11B4
NtQueryInformationToken, xrefs: 02ED1262
RtlInitUnicodeString, xrefs: 02ED1135
ntdll.dll, xrefs: 02ED100D
RtlSetLastWin32Error, xrefs: 02ED10D6

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 2955d7ca7c0b3467e11819169f7c1dc1c3ef9b1af16cad999cd011100d2701a6
Instruction ID: a35eab460850d77a105b1d878d2fe363b96b12f00189f4c5b051e370e8ec9cea
Opcode Fuzzy Hash: 2955d7ca7c0b3467e11819169f7c1dc1c3ef9b1af16cad999cd011100d2701a6
Instruction Fuzzy Hash: F751B8719C6701E6EF109A6EAC4077133E46368228F8497D6B829DF2D4D775C8D2CF51

Function 02EDB211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02EDB2B3
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 02EDB2C2
FileTimeToSystemTime.KERNEL32(?,?), ref: 02EDB2D0
SystemTimeToFileTime.KERNEL32(?,?), ref: 02EDB2E1
FileTimeToSystemTime.KERNEL32(?,?), ref: 02EDB31A
GetTimeZoneInformation.KERNEL32(?), ref: 02EDB329
wsprintfA.USER32 ref: 02EDB3B7

Strings

Fri, xrefs: 02EDB248
Nov, xrefs: 02EDB29C
Apr, xrefs: 02EDB26B
Feb, xrefs: 02EDB25D
Sun, xrefs: 02EDB225
Wed, xrefs: 02EDB23A
Aug, xrefs: 02EDB287
Sep, xrefs: 02EDB28E
Sat, xrefs: 02EDB24F
Jan, xrefs: 02EDB256
Tue, xrefs: 02EDB233
Jun, xrefs: 02EDB279
Mon, xrefs: 02EDB22C
Thu, xrefs: 02EDB241
Jul, xrefs: 02EDB280
Dec, xrefs: 02EDB2A3
Mar, xrefs: 02EDB264
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 02EDB3AF
May, xrefs: 02EDB272
Oct, xrefs: 02EDB295

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 394caeee76dba3ede0b51d1fc612b79999db58fb94a576a28acb7e031a4cc71f
Instruction ID: a86699e0eb4db9d5414b77ec100738392456419fc19c15174c7cf0fd30c0462f
Opcode Fuzzy Hash: 394caeee76dba3ede0b51d1fc612b79999db58fb94a576a28acb7e031a4cc71f
Instruction Fuzzy Hash: F4511DB1E80218EBCF14CFD5D9855EFBBB9EF48308F519459E502BA150D3B44A89CB60

Function 02ED6511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02ED654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 02ED655C
htonl.WS2_32(?), ref: 02ED6578
htonl.WS2_32(?), ref: 02ED6587
wsprintfA.USER32 ref: 02ED659B
wsprintfA.USER32 ref: 02ED65DC
wsprintfA.USER32 ref: 02ED6671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02ED668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 02ED6696
wsprintfA.USER32 ref: 02ED66B0
wsprintfA.USER32 ref: 02ED66E7
wsprintfA.USER32 ref: 02ED66FF
wsprintfA.USER32 ref: 02ED671F
ExitProcess.KERNEL32 ref: 02ED6755

Strings

plgs:, xrefs: 02ED66AA
12:08:32, xrefs: 02ED6535
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 02ED666B
%d=%p, xrefs: 02ED66F9
localcfg, xrefs: 02ED672D
except_info, xrefs: 02ED6728
Jan 13 2018, xrefs: 02ED653A
ver=%d date=%s %sc=%08x a=%p, xrefs: 02ED6547
va=%08X%08X uef=%p, xrefs: 02ED6595
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 02ED65D6

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 610c5996e76fdff11660a3fe048cdcc4335d8147734b0d33559f8d0bf360bbbc
Instruction ID: b515b665212ce5a30103f2aa926d387b584bdabb72251931993e881d89974c84
Opcode Fuzzy Hash: 610c5996e76fdff11660a3fe048cdcc4335d8147734b0d33559f8d0bf360bbbc
Instruction Fuzzy Hash: 39616D72980208EFEF609FB4DC45FEA77F9FB08300F148469F96AE6151EA7199558F10

Function 02EDA7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02EDA7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 02EDA87E
send.WS2_32(00000000,?,00000000,00000000), ref: 02EDA893
wsprintfA.USER32 ref: 02EDA8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 02EDA8D2
wsprintfA.USER32 ref: 02EDA8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 02EDA97C
wsprintfA.USER32 ref: 02EDA9B9

Strings

rcpt to:<%s>, xrefs: 02EDA855
mail from:<%s>, xrefs: 02EDA848
Too small respons, xrefs: 02EDA9C9
localcfg, xrefs: 02EDAB0B
AUTH LOGIN, xrefs: 02EDA80C
data, xrefs: 02EDA85E
ehlo %s, xrefs: 02EDA7F5
Error sending command (sent = %d/%d), xrefs: 02EDA8A7, 02EDA8DA
Incorrect respons, xrefs: 02EDAB39
helo %s, xrefs: 02EDA803
Too big smtp respons (%d bytes), xrefs: 02EDA9B1
quit, xrefs: 02EDA86C
ESMTP, xrefs: 02EDAA38
., xrefs: 02EDA8CA

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 098715a3a00eb95dd5c6e42e38c42cc5680286fb14a26b3ec000dbca01a6c327
Instruction ID: 53ae52d8408606af7224fb6c10019454d0de55e2eb870e8774475714782626b0
Opcode Fuzzy Hash: 098715a3a00eb95dd5c6e42e38c42cc5680286fb14a26b3ec000dbca01a6c327
Instruction Fuzzy Hash: 6BA12B719C4305AAEF208A54DC99FBE776AEB0030CF18E476F9066B280D7B19787CB55

Function 02ED1280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02ED139A
lstrlenW.KERNEL32(-00000003), ref: 02ED1571

Strings

useless, xrefs: 02ED161E
uac, xrefs: 02ED1628
<, xrefs: 02ED1378
@, xrefs: 02ED1380
%systemroot%\system32\cmd.exe, xrefs: 02ED1316
, xrefs: 02ED1462
wusa.exe, xrefs: 02ED1388
D, xrefs: 02ED15C6

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: afd8a7bb65e577a9e2764f1cd220d608ff3b7b6104e7e98f188ca8ba229a2578
Instruction ID: bbfdee14ece2c6ad74e1bf962b512fac3aec9e22ba8d82b57b512e24007da46b
Opcode Fuzzy Hash: afd8a7bb65e577a9e2764f1cd220d608ff3b7b6104e7e98f188ca8ba229a2578
Instruction Fuzzy Hash: CFF1BDB5588341DFD720CF64C888BAAB7E5FB89308F408D1DF99A9B290D774D885CB52

Function 02ED2A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,774CF380), ref: 02ED2A83
HeapAlloc.KERNEL32(00000000,?,774CF380), ref: 02ED2A86
socket.WS2_32(00000002,00000002,00000011), ref: 02ED2AA0
htons.WS2_32(00000000), ref: 02ED2ADB
select.WS2_32 ref: 02ED2B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 02ED2B4A
htons.WS2_32(?), ref: 02ED2B71
htons.WS2_32(?), ref: 02ED2B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02ED2BFB

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: a4299f7c0972143a3f535f86e5212c2f45bb9d946cbea3433f18f109d905560c
Instruction ID: 0cf37687045a0007691525f15b0b120ae5fca72102cc42afc0016fea09154869
Opcode Fuzzy Hash: a4299f7c0972143a3f535f86e5212c2f45bb9d946cbea3433f18f109d905560c
Instruction Fuzzy Hash: E261D571984305DFDB209F65DC08BABB7E8FB48755F019C09FE49AB142D7B0D8818BA1

Function 02ED704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,774D0F10,?,774D0F10,00000000), ref: 02ED70C2
RegEnumValueA.ADVAPI32(774D0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,774D0F10,00000000), ref: 02ED719E
RegCloseKey.ADVAPI32(774D0F10,?,774D0F10,00000000), ref: 02ED71B2
RegCloseKey.ADVAPI32(774D0F10), ref: 02ED7208
RegCloseKey.ADVAPI32(774D0F10), ref: 02ED7291
___ascii_stricmp.LIBCMT ref: 02ED72C2
RegCloseKey.ADVAPI32(774D0F10), ref: 02ED72D0
RegCloseKey.ADVAPI32(774D0F10), ref: 02ED7314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02ED738D
RegCloseKey.ADVAPI32(774D0F10), ref: 02ED73D8

Part of subcall function 02EDF1A5: lstrlenA.KERNEL32(000000C8,000000E4,02EE22F8,000000C8,02ED7150,?), ref: 02EDF1AD

Strings

, xrefs: 02ED7194
", xrefs: 02ED7227

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: a571a85ccecf9474de2c39126421997ccfa26d59c3e9a064051f522827d517e2
Instruction ID: fd60c26bda0d21595bd795fa757d40057d838c7d8cad395f68d05ba0476eff9c
Opcode Fuzzy Hash: a571a85ccecf9474de2c39126421997ccfa26d59c3e9a064051f522827d517e2
Instruction Fuzzy Hash: F4B18072C84209AFDF15EFA0DC44BEEB7B9EF04304F149566F905E6080EB719A96CB60

Function 02EDAD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02EDAD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 02EDADA6

Part of subcall function 02EDAD08: gethostname.WS2_32(?,00000080), ref: 02EDAD1C
Part of subcall function 02EDAD08: lstrlenA.KERNEL32(?), ref: 02EDAD60
Part of subcall function 02EDAD08: lstrlenA.KERNEL32(?), ref: 02EDAD69
Part of subcall function 02EDAD08: lstrcpyA.KERNEL32(?,LocalHost), ref: 02EDAD7F

Part of subcall function 02ED30B5: gethostname.WS2_32(?,00000080), ref: 02ED30D8
Part of subcall function 02ED30B5: gethostbyname.WS2_32(?), ref: 02ED30E2

wsprintfA.USER32 ref: 02EDAEA5

Part of subcall function 02EDA7A3: inet_ntoa.WS2_32(?), ref: 02EDA7A9

wsprintfA.USER32 ref: 02EDAE4F
wsprintfA.USER32 ref: 02EDAE5E

Part of subcall function 02EDEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 02EDEF92
Part of subcall function 02EDEF7C: lstrlenA.KERNEL32(?), ref: 02EDEF99
Part of subcall function 02EDEF7C: lstrlenA.KERNEL32(00000000), ref: 02EDEFA0

Strings

----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 02EDAE49
%OUTLOOK_BND_, xrefs: 02EDAE0F, 02EDAE14, 02EDAE57, 02EDAE76
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 02EDAE9F
%s%d, xrefs: 02EDAE58
%OUTLOOK_HST, xrefs: 02EDAEC5
127.0.0.1, xrefs: 02EDADEB
%OUTLOOK_MID, xrefs: 02EDAEAE

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 15f671e56f2256b6aa8063b52d351059faf41a6495a971e1b1a3f55e227b58d5
Instruction ID: d6e8793b42593b373cc14eb1747ad02789b4d27cbef2c2d0363b421c3c313b32
Opcode Fuzzy Hash: 15f671e56f2256b6aa8063b52d351059faf41a6495a971e1b1a3f55e227b58d5
Instruction Fuzzy Hash: 4B4162B298020CBBDF25EFA1CC45EEF3BADFB08304F148426B915A6151EA71D655CF60

Function 02ED2DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,774D23A0,?,000DBBA0,?,00000000,02ED2F0F,?,02ED20FF,02EE2000), ref: 02ED2E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,02ED2F0F,?,02ED20FF,02EE2000), ref: 02ED2E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 02ED2E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,02ED2F0F,?,02ED20FF,02EE2000), ref: 02ED2E4C
HeapAlloc.KERNEL32(00000000,?,00000000,02ED2F0F,?,02ED20FF,02EE2000), ref: 02ED2E4F
htons.WS2_32(00000035), ref: 02ED2E88
inet_addr.WS2_32(?), ref: 02ED2E93
gethostbyname.WS2_32(?), ref: 02ED2EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,02ED2F0F,?,02ED20FF,02EE2000), ref: 02ED2EE3
HeapFree.KERNEL32(00000000,?,00000000,02ED2F0F,?,02ED20FF,02EE2000), ref: 02ED2EE6

Strings

iphlpapi.dll, xrefs: 02ED2DFB, 02ED2E00, 02ED2E10
GetNetworkParams, xrefs: 02ED2E28

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 0f09d267425e8be7263f5d97fecb3259eff3c8321a3f1b3ac0bf2b8cdd011205
Instruction ID: c001164d1da5442eea57106dcaab7eb84789ba9b6d6c84c74de0a7112a949d2f
Opcode Fuzzy Hash: 0f09d267425e8be7263f5d97fecb3259eff3c8321a3f1b3ac0bf2b8cdd011205
Instruction Fuzzy Hash: 2331D531DC0205EBDF129BB9D844B6E77B8AF04328F14A515FE14FB181E770C5828B64

Function 02ED9326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,02ED9DD7,?,00000022,?,?,00000000,00000001), ref: 02ED9340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,02ED9DD7,?,00000022,?,?,00000000,00000001), ref: 02ED936E
GetModuleFileNameA.KERNEL32(00000000,?,02ED9DD7,?,00000022,?,?,00000000,00000001), ref: 02ED9375
wsprintfA.USER32 ref: 02ED93CE
wsprintfA.USER32 ref: 02ED940C
wsprintfA.USER32 ref: 02ED948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02ED94F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02ED9526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02ED9571

Strings

runas, xrefs: 02ED9674

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 4c7d88abbed3f549090d3415f8e6c09fad73251fe4023045196ced2094f97611
Instruction ID: b96310f7e6ab1064c68d1d946d69d052dedc896e0ccbc0293606661494923754
Opcode Fuzzy Hash: 4c7d88abbed3f549090d3415f8e6c09fad73251fe4023045196ced2094f97611
Instruction Fuzzy Hash: 14A18EB29C0248EFEF219FA1CC44FDE3BACEB04744F109465FA15A6142D7759686CFA1

Function 02ED2011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02ED2078
GetTickCount.KERNEL32 ref: 02ED20D4
GetTickCount.KERNEL32 ref: 02ED20DB
GetTickCount.KERNEL32 ref: 02ED212B
GetTickCount.KERNEL32 ref: 02ED2132
GetTickCount.KERNEL32 ref: 02ED2142

Part of subcall function 02EDF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02EDE342,00000000,7597EA50,80000001,00000000,02EDE513,?,00000000,00000000,?,000000E4), ref: 02EDF089
Part of subcall function 02EDF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02EDE342,00000000,7597EA50,80000001,00000000,02EDE513,?,00000000,00000000,?,000000E4,000000C8), ref: 02EDF093

Part of subcall function 02EDE854: lstrcpyA.KERNEL32(00000001,?,?,02EDD8DF,00000001,localcfg,except_info,00100000,02EE0264), ref: 02EDE88B
Part of subcall function 02EDE854: lstrlenA.KERNEL32(00000001,?,02EDD8DF,00000001,localcfg,except_info,00100000,02EE0264), ref: 02EDE899

Part of subcall function 02ED1C5F: wsprintfA.USER32 ref: 02ED1CE1

Strings

localcfg, xrefs: 02ED2070, 02ED2160, 02ED2186, 02ED2194, 02ED21E4
net_type, xrefs: 02ED21DF
rbl_bl, xrefs: 02ED2181
rbl_ip, xrefs: 02ED218F

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 31ab9a0d6c1687d50432c48834447cbc286ddcbb808311a8c31f8b7e028af8b9
Instruction ID: 84ebaefc7bc76e71ca91740fd53bb49fc2d40a8f8f41772f1eea0bd7c34203af
Opcode Fuzzy Hash: 31ab9a0d6c1687d50432c48834447cbc286ddcbb808311a8c31f8b7e028af8b9
Instruction Fuzzy Hash: A7513830DC43458EEF28DF31ED45B563BDAAB09318F809819FF0A9E191DBF09596CA24

Function 02EDB3F8 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 124COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02EDB467

Part of subcall function 02EDEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 02EDEF92
Part of subcall function 02EDEF7C: lstrlenA.KERNEL32(?), ref: 02EDEF99
Part of subcall function 02EDEF7C: lstrlenA.KERNEL32(00000000), ref: 02EDEFA0

Strings

%DATE, xrefs: 02EDB4D2
%s@%s, xrefs: 02EDB461
%M5DATE, xrefs: 02EDB50F
%P5DATE, xrefs: 02EDB4F2
%TO_USER, xrefs: 02EDB488
%FROM_DOMAIN, xrefs: 02EDB41E
%TO_EMAIL, xrefs: 02EDB473
%TO_DOMAIN, xrefs: 02EDB44B
%TO_HASH, xrefs: 02EDB4B0
%FROM_USER, xrefs: 02EDB431

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-3679488032
Opcode ID: db9610b7b9d12bbacc1085b3e8e6714f7347d6e84d5fa9f115fa0581ba438d50
Instruction ID: 11840b4eddc978442fcfb220f73aa8e55cf30e690ab6599afaed045a90780515
Opcode Fuzzy Hash: db9610b7b9d12bbacc1085b3e8e6714f7347d6e84d5fa9f115fa0581ba438d50
Instruction Fuzzy Hash: 3F3189B25C01187EEF01BBA4CCC5CFF7B6EEE49348F189015F906B5100EB70AA168BA1

Function 02EDC2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02EDA4C7: GetTickCount.KERNEL32 ref: 02EDA4D1
Part of subcall function 02EDA4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 02EDA4FA

GetTickCount.KERNEL32 ref: 02EDC31F
GetTickCount.KERNEL32 ref: 02EDC32B
GetTickCount.KERNEL32 ref: 02EDC363
GetTickCount.KERNEL32 ref: 02EDC378
GetTickCount.KERNEL32 ref: 02EDC44D
InterlockedIncrement.KERNEL32(02EDC4E4), ref: 02EDC4AE
CreateThread.KERNEL32(00000000,00000000,02EDB535,00000000,?,02EDC4E0), ref: 02EDC4C1
CloseHandle.KERNEL32(00000000,?,02EDC4E0,02EE3588,02ED8810), ref: 02EDC4CC

Strings

localcfg, xrefs: 02EDC2DD

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 1a5cfe5152bb219249e3e72babe1a0d1972a0d65c5b1e88efe779445a3d31d46
Instruction ID: 50077627102460a7dae7929594043b342287662fb5710313de3762fbfe36e55d
Opcode Fuzzy Hash: 1a5cfe5152bb219249e3e72babe1a0d1972a0d65c5b1e88efe779445a3d31d46
Instruction Fuzzy Hash: D2514CB1A80B418FD7249F69C58452ABBE9FB48344B60BD3EE18BC7A90D774F845CB14

Function 02EDBE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02EDBE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02EDBE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02EDBE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02EDBF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02EDBF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02EDBF94

Strings

smtp_retr, xrefs: 02EDBE61, 02EDBF8C
smtp_herr, xrefs: 02EDBE46, 02EDBF62
smtp_ban, xrefs: 02EDBE55, 02EDBF77

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 1f066b6b7a49c538f7b9025c3ffff044e306dbf74a9149eea2d753de5d1c60db
Instruction ID: 29125b5e4bb292d54de79ad9d0a83061093f63ac1d0a408c0a55cfb953eae590
Opcode Fuzzy Hash: 1f066b6b7a49c538f7b9025c3ffff044e306dbf74a9149eea2d753de5d1c60db
Instruction Fuzzy Hash: B151A871A80219EFDF119F65CD40B6DBBB9AF4434CF45E459E842AB210E770E942CF90

Function 02ED6A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,774C8A60,?,?,?,?,02ED9A60,?,?,02ED9E9D), ref: 02ED6A7D
GetDiskFreeSpaceA.KERNEL32(02ED9E9D,02ED9A60,?,?,?,02EE22F8,?,?,?,02ED9A60,?,?,02ED9E9D), ref: 02ED6ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,02ED9A60,?,?,02ED9E9D), ref: 02ED6B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02ED9A60,?,?,02ED9E9D), ref: 02ED6B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02ED9A60,?,?,02ED9E9D), ref: 02ED6B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,02ED9A60,?,?,02ED9E9D), ref: 02ED6B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02ED9A60,?,?,02ED9E9D), ref: 02ED6B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,02ED9A60,?,?,02ED9E9D), ref: 02ED6B80
GetLastError.KERNEL32(?,?,?,02ED9A60,?,?,02ED9E9D,?,?,?,?,?,02ED9E9D,?,00000022,?), ref: 02ED6B96

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 59e5645287f3fc9200d7e6eb77339a35a95ba09e525899adf037989a059e27a8
Instruction ID: 5147a9127074861733f05c50cf9000e895cd37b1e9d40643dbecfc35aef3cb71
Opcode Fuzzy Hash: 59e5645287f3fc9200d7e6eb77339a35a95ba09e525899adf037989a059e27a8
Instruction Fuzzy Hash: 7F31EEB2DC0249EFCF019FA19884ADEBB7DEB48314F048866F651AB240D77096968F61

Function 02ED6F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,02EDD7C3), ref: 02ED6F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,02EDD7C3), ref: 02ED6FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 02ED6FE8
LocalFree.KERNEL32(00000120), ref: 02ED701F
wsprintfA.USER32 ref: 02ED7036

Strings

|, xrefs: 02ED6FB3
/%d, xrefs: 02ED7030

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: bb261e59558ebf3a645991de9a4a462d8a4cd392f7a15f1018e88343f31bbede
Instruction ID: fdb77f79f5b2f869ad4d61cc8f45c20dd6a70f6fe230cbb560af621c8db61333
Opcode Fuzzy Hash: bb261e59558ebf3a645991de9a4a462d8a4cd392f7a15f1018e88343f31bbede
Instruction Fuzzy Hash: 60312772940209AFDB01DFA9D848BDA7BACEF04318F04D066F809DB140EA74D6098BA0

Function 02ED6CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,02EE22F8,000000E4,02ED6DDC,000000C8), ref: 02ED6CE7
GetProcAddress.KERNEL32(00000000), ref: 02ED6CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02ED6D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02ED6D2B

Strings

GetSystemWow64DirectoryA, xrefs: 02ED6CDD
C:\Windows\SysWOW64\, xrefs: 02ED6CC9, 02ED6CD1, 02ED6CFE, 02ED6D05, 02ED6D13, 02ED6D1E, 02ED6D2A, 02ED6D42, 02ED6D5F, 02ED6D85
kernel32, xrefs: 02ED6CE2

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: e99128de8c91915e6637d3833a2e6aa045098ebeeafef965d2b3d66ee92c3dd4
Instruction ID: 7810dc1ec451976429c00c9d5f5d3b5688467136b597ed0754cfb23cf84237a1
Opcode Fuzzy Hash: e99128de8c91915e6637d3833a2e6aa045098ebeeafef965d2b3d66ee92c3dd4
Instruction Fuzzy Hash: EB210451AC0254BDFF227A33BC88F672F5D8B43608F0CE444FA05AE095C7D4848782B6

Function 02ED977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02ED9947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,02EE22F8), ref: 02ED97B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,02EE22F8), ref: 02ED97EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,02EE22F8), ref: 02ED97F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,02EE22F8), ref: 02ED9831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,02EE22F8), ref: 02ED984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,02EE22F8), ref: 02ED985B

Strings

D, xrefs: 02ED97A9

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: c5e80b4254b13af911d0d35ca3a2ac81c3ef1a859a658b1c6d79a350c565c97a
Instruction ID: cf1d55e9ca21d7d2b205f9fa0dfa9121f0026501d404df2e2d944305c37886a1
Opcode Fuzzy Hash: c5e80b4254b13af911d0d35ca3a2ac81c3ef1a859a658b1c6d79a350c565c97a
Instruction Fuzzy Hash: EE216B71D81219BBDF119FA2EC48FEF7BBCEF08654F404460BA09E9040EB709A55CAA0

Function 02EDE8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02EDDD05: GetTickCount.KERNEL32 ref: 02EDDD0F
Part of subcall function 02EDDD05: InterlockedExchange.KERNEL32(02EE36B4,00000001), ref: 02EDDD44
Part of subcall function 02EDDD05: GetCurrentThreadId.KERNEL32 ref: 02EDDD53

Part of subcall function 02EDDD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 02EDDDB5

lstrcpynA.KERNEL32(?,02ED1E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,02EDEAAA,?,?), ref: 02EDE8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,02EDEAAA,?,?,00000001,?,02ED1E84,?), ref: 02EDE935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,02EDEAAA,?,?,00000001,?,02ED1E84,?,0000000A), ref: 02EDE93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,02EDEAAA,?,?,00000001,?,02ED1E84,?), ref: 02EDE94F

Strings

localcfg, xrefs: 02EDE8AB
flags_upd, xrefs: 02EDE8A7

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: ba7d41ceecfdd338e8cd8795efa2d15a20d3a8fa7a9b0ccfab0a710e288547b2
Instruction ID: 24eceaf62c7c45dc410859a199172944ed7c3fb3a95ac5b5dc77455a7a15be48
Opcode Fuzzy Hash: ba7d41ceecfdd338e8cd8795efa2d15a20d3a8fa7a9b0ccfab0a710e288547b2
Instruction Fuzzy Hash: DE512E7294020AAFCF11EFA8CD849AEB7F9BF48308F145569F505A7210E775EA15CF60

Function 02ED6BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02ED6BB2

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: cbbe0252c52a836537b29fe0ecaad6867a3e997f37ea31f1eeed71f08389013e
Instruction ID: 16d51ba0884d66ea66d1f9e03f534d83053f665630257ef9cf6c2286b264aa1b
Opcode Fuzzy Hash: cbbe0252c52a836537b29fe0ecaad6867a3e997f37ea31f1eeed71f08389013e
Instruction Fuzzy Hash: 1C215B72984105FEDF119BA1FD88DEF3BACDB44368B10AC15F502E5080EB719A52DA64

Function 02ED9064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,02EE22F8), ref: 02ED907B
wsprintfA.USER32 ref: 02ED90E9
CreateFileA.KERNEL32(02EE22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02ED910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02ED9122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02ED912D
CloseHandle.KERNEL32(00000000), ref: 02ED9134

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: e0f2af3a8227062c3c4d960b4533eefda256ce83e59e88a1e8f010039e0295f5
Instruction ID: cb79468199240e6b2af28c7910a2508d474b6f1c8b948ef0f48a048d40c44eb0
Opcode Fuzzy Hash: e0f2af3a8227062c3c4d960b4533eefda256ce83e59e88a1e8f010039e0295f5
Instruction Fuzzy Hash: E0118BB2AC0154BBFB156672DC0DFEF366EDBC5710F04C865BB0AB9040DA7049528A70

Function 02EDDD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02EDDD0F
GetCurrentThreadId.KERNEL32 ref: 02EDDD20
GetTickCount.KERNEL32 ref: 02EDDD2E
Sleep.KERNEL32(00000000,?,774D0F10,?,00000000,02EDE538,?,774D0F10,?,00000000,?,02EDA445), ref: 02EDDD3B
InterlockedExchange.KERNEL32(02EE36B4,00000001), ref: 02EDDD44
GetCurrentThreadId.KERNEL32 ref: 02EDDD53

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: d2310a2a937436073b36bf93ef4e2016d34573d28e2120c61432f8f6b046a329
Instruction ID: d6072c9ce199dda56a49dfeed3f7d262d7e88e307b1db80764c95e435f8f66ca
Opcode Fuzzy Hash: d2310a2a937436073b36bf93ef4e2016d34573d28e2120c61432f8f6b046a329
Instruction Fuzzy Hash: 20F09AB29C4205DFCF809AA6EC84B393BA4E746312F808D55F109DB240E76090A6CE22

Function 02EDAD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02EDAD1C
lstrlenA.KERNEL32(?), ref: 02EDAD60
lstrlenA.KERNEL32(?), ref: 02EDAD69
lstrcpyA.KERNEL32(?,LocalHost), ref: 02EDAD7F

Strings

LocalHost, xrefs: 02EDAD79

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: f875b34445f933a56d3cd3da9394fca92977580efeeea4fb6bc5d08e6cd0896c
Instruction ID: fde9ae1632bcfda958f820aa2545416d072a858ca56a07c561f4b85fbd9ece5c
Opcode Fuzzy Hash: f875b34445f933a56d3cd3da9394fca92977580efeeea4fb6bc5d08e6cd0896c
Instruction Fuzzy Hash: 2601F520CC41899DDF315638D444BF93F66AB8760EF50F079E4C19B315EFA486878762

Function 02ED4BD1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02ED4BDD
GetTickCount.KERNEL32 ref: 02ED4BEC
Sleep.KERNEL32(00000000,?,%FROM_EMAIL,02ED5D02,00000000,?,02EDB85C,?,00000080,?,00000000,00000000,?,%FROM_EMAIL), ref: 02ED4BF9
InterlockedExchange.KERNEL32(0321B1A8,00000001), ref: 02ED4C02

Strings

%FROM_EMAIL, xrefs: 02ED4BD1

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID: %FROM_EMAIL
API String ID: 2207858713-2903620461
Opcode ID: 3cdbfa2201868ef02a10a81e2c9682ecacc4bf55194259592869f17bdffb4490
Instruction ID: e0fe8b717f08c0f352e32cfe47befd388dea2e3e4fe6e4b293b68ad261028c86
Opcode Fuzzy Hash: 3cdbfa2201868ef02a10a81e2c9682ecacc4bf55194259592869f17bdffb4490
Instruction Fuzzy Hash: F0E0CD376C121497DB1016F7DC80FAA775CDBA5371F464C72F708E61C0D5E6949245B1

Function 02ED4280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02ED98FD,00000001,00000100,02EE22F8,02EDA3C7), ref: 02ED4290
CloseHandle.KERNEL32(02EDA3C7), ref: 02ED43AB
CloseHandle.KERNEL32(00000001), ref: 02ED43AE

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 10805bbbb4af4f078d301896d39429c91d61db4b0b0a3566b78f98c1a0721da0
Instruction ID: 08da86a1ac24f432e8cab6a66f5d9455c554cb90ade48f2ddea71a2e85073a7f
Opcode Fuzzy Hash: 10805bbbb4af4f078d301896d39429c91d61db4b0b0a3566b78f98c1a0721da0
Instruction Fuzzy Hash: 1C419CB1880209BBDF10ABA6DD85FEFBBB9EF40324F109955F604A61C0D7359642CFA1

Function 02ED6069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,02ED64CF,00000000), ref: 02ED609C
LoadLibraryA.KERNEL32(?,?,02ED64CF,00000000), ref: 02ED60C3
GetProcAddress.KERNEL32(?,00000014), ref: 02ED614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02ED619E

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: cb716786030f09d0d1920546d0508b93c3141eab46cca799e1169fd61e1dec70
Instruction ID: 55842e8f5a21f3d79c0f914216608ae6512b2b0bcfd3ed17b596e61c090e10d4
Opcode Fuzzy Hash: cb716786030f09d0d1920546d0508b93c3141eab46cca799e1169fd61e1dec70
Instruction Fuzzy Hash: F4417F71E80106EFDB24CF59E884BA9B7B9FF04358F14C169E819DB291D730E942CBA0

Function 02ED2923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96c6fdb44bc0542741b463e0960039768a419d57ad125cfb45dc7c3b36488
Instruction ID: 826043fe5784acbc1d3c7898faec98e2c15431471102415936913d6d89ffd41f
Opcode Fuzzy Hash: 5bc96c6fdb44bc0542741b463e0960039768a419d57ad125cfb45dc7c3b36488
Instruction Fuzzy Hash: 75319171980208EBDF109FA5CC81BBEB7F4EF48705F109456FA05EB242E374D6428B64

Function 02ED26FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02ED272E
htons.WS2_32(00000001), ref: 02ED2752
htons.WS2_32(0000000F), ref: 02ED27D5
htons.WS2_32(00000001), ref: 02ED27E3
sendto.WS2_32(?,02EE2BF8,00000009,00000000,00000010,00000010), ref: 02ED2802

Part of subcall function 02EDEBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02EDEBFE,7FFF0001,?,02EDDB55,7FFF0001), ref: 02EDEBD3
Part of subcall function 02EDEBCC: RtlAllocateHeap.NTDLL(00000000,?,02EDDB55,7FFF0001), ref: 02EDEBDA

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 63f9dc54ad024e08a077504d3576e8b91617559c9b3ae7ccbbb242b44a3d2832
Instruction ID: 24b6f955fdbad644d650f3523373b040403bc3927ad11411fd138c58a9d559ed
Opcode Fuzzy Hash: 63f9dc54ad024e08a077504d3576e8b91617559c9b3ae7ccbbb242b44a3d2832
Instruction Fuzzy Hash: E1314634AC038ADFEB208F75D8A0A617768EF19318B59985DFE598F303D2729482CB14

Function 02ED9145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,02EE22F8), ref: 02ED915F
GetModuleFileNameA.KERNEL32(00000000), ref: 02ED9166
CharToOemA.USER32(?,?), ref: 02ED9174
wsprintfA.USER32 ref: 02ED91A9

Part of subcall function 02ED9064: GetTempPathA.KERNEL32(00000400,?,00000000,02EE22F8), ref: 02ED907B
Part of subcall function 02ED9064: wsprintfA.USER32 ref: 02ED90E9
Part of subcall function 02ED9064: CreateFileA.KERNEL32(02EE22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02ED910E
Part of subcall function 02ED9064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02ED9122
Part of subcall function 02ED9064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02ED912D
Part of subcall function 02ED9064: CloseHandle.KERNEL32(00000000), ref: 02ED9134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02ED91E1

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: c926335fabd24ee592c069b3c8734e99284f45080c3cd601f1cd7eeb2a2833ff
Instruction ID: 4c58e1bb030ffd270ab9a2f85f423ab5b50e3f14fabbcc382abe10d609a1d6bf
Opcode Fuzzy Hash: c926335fabd24ee592c069b3c8734e99284f45080c3cd601f1cd7eeb2a2833ff
Instruction Fuzzy Hash: BF0140F6980118BBEA20A662DD49FDF777CDB95701F400491BB49FA040D6B096868F71

Function 02ED2419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,02ED2491,?,?,?,02EDE844,-00000030,?,?,?,00000001), ref: 02ED2429
lstrlenA.KERNEL32(?,?,02ED2491,?,?,?,02EDE844,-00000030,?,?,?,00000001,02ED1E3D,00000001,localcfg,lid_file_upd), ref: 02ED243E
lstrcmpiA.KERNEL32(?,?), ref: 02ED2452
lstrlenA.KERNEL32(?,?,02ED2491,?,?,?,02EDE844,-00000030,?,?,?,00000001,02ED1E3D,00000001,localcfg,lid_file_upd), ref: 02ED2467

Strings

localcfg, xrefs: 02ED241F

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 83b245f5de3da1071840d15e11d9c9ab4cdcc939ff4720565b4e1c5ed7f410c0
Instruction ID: 520037c6ca8b9341f8dfc636a69fe2d399b115f072fba24d0890627b96e86bbc
Opcode Fuzzy Hash: 83b245f5de3da1071840d15e11d9c9ab4cdcc939ff4720565b4e1c5ed7f410c0
Instruction Fuzzy Hash: 03011A31640218EFCF11EF69CC809DE7BB9EF44368B01D425FD59A7201E370EA518A90

Function 02ED1C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02ED1CE1
wsprintfA.USER32 ref: 02ED1D6B

Strings

localcfg, xrefs: 02ED1C70
%u.%u.%u.%u.%s, xrefs: 02ED1CDB, 02ED1D65

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: e7ffb6700c5d351fd87ff424bc8b3544178fe32bdcf73e6a825ab9d89cf388de
Instruction ID: 038f1aa280744d8088af2da8f25df74f43aaba424986d9187abb6eab32fb4e9a
Opcode Fuzzy Hash: e7ffb6700c5d351fd87ff424bc8b3544178fe32bdcf73e6a825ab9d89cf388de
Instruction Fuzzy Hash: C741A9729442989FDB21CFB88844BEE3BE99F4A311F244056FDA4DB142D634DA06CBA0

Function 02EDE654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02EDDD05: GetTickCount.KERNEL32 ref: 02EDDD0F
Part of subcall function 02EDDD05: InterlockedExchange.KERNEL32(02EE36B4,00000001), ref: 02EDDD44
Part of subcall function 02EDDD05: GetCurrentThreadId.KERNEL32 ref: 02EDDD53

lstrcmpA.KERNEL32(774D0F18,00000000,?,774D0F10,00000000,?,02ED5EC1), ref: 02EDE693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,774D0F10,00000000,?,02ED5EC1), ref: 02EDE6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,774D0F10,00000000,?,02ED5EC1), ref: 02EDE722

Strings

89ABCDEF, xrefs: 02EDE721

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 413b1ea6737e1dd5175c238cff3c888b7698f50794c0d39a96b1d31d70a616b5
Instruction ID: 804b8d5d4d30f2733e1d8da834415ccf7f3a1c4bb403278eb882a59e4b5a1c36
Opcode Fuzzy Hash: 413b1ea6737e1dd5175c238cff3c888b7698f50794c0d39a96b1d31d70a616b5
Instruction Fuzzy Hash: B031C435980705DFCF318F65D88876677E9BB01328F18D92EE5658F581E770E882CB91

Function 02EDE095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02EDE2A3,00000000,00000000,00000000,00020106,00000000,02EDE2A3,00000000,000000E4), ref: 02EDE0B2
RegSetValueExA.ADVAPI32(02EDE2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,02EE22F8), ref: 02EDE127
RegDeleteValueA.ADVAPI32(02EDE2A3,?,?,?,?,?,000000C8,02EE22F8), ref: 02EDE158
RegCloseKey.ADVAPI32(02EDE2A3,?,?,?,?,000000C8,02EE22F8,?,?,?,?,?,?,?,?,02EDE2A3), ref: 02EDE161

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 91b001ddf07161c89bbc01899b16da9b11ca27e767efc1fc3472ec8c485a0c3e
Instruction ID: 4dcc91538844b41b35a58a3b0f08c700dafe740044d13060a64cca9fa687ea1b
Opcode Fuzzy Hash: 91b001ddf07161c89bbc01899b16da9b11ca27e767efc1fc3472ec8c485a0c3e
Instruction Fuzzy Hash: 1F218E71E80219BBDF209EA5DC89EDE7F79EF08754F048061F904AA150E7718A55CBA0

Function 02ED3F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,02EDA3C7,00000000,00000000,000007D0,00000001), ref: 02ED3FB8
GetLastError.KERNEL32 ref: 02ED3FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 02ED3FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02ED3FE6

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 6232dfd48b695ae9f91c6a0adedef2b09780c9bc0aea6087ecf911feca0ca0f9
Instruction ID: 6715ea2af36f8e6b30f46815e59d37ed091cd82075aa2423ff3fb426247e0c27
Opcode Fuzzy Hash: 6232dfd48b695ae9f91c6a0adedef2b09780c9bc0aea6087ecf911feca0ca0f9
Instruction Fuzzy Hash: 3801297295010EABDF01DF92D985BEE3B7CEB04355F408851F902E6040D770DA658FB2

Function 02ED3F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,02EDA3C7,00000000,00000000,000007D0,00000001), ref: 02ED3F44
GetLastError.KERNEL32 ref: 02ED3F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 02ED3F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02ED3F72

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: d83ecc1bfb0a658cfe1386c6059439f6f816e173569c35a79fcde457e69ff131
Instruction ID: ec10eb4684c850446ddba82add6fcf013838e0a7ae2393865e55c9093fbfda25
Opcode Fuzzy Hash: d83ecc1bfb0a658cfe1386c6059439f6f816e173569c35a79fcde457e69ff131
Instruction Fuzzy Hash: 4101D3B2991109ABDF01DE92D984BEE7BBCEB04359F508865FA01E6040D7709A658BA2

Function 02EDA4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02EDA4D1
GetTickCount.KERNEL32 ref: 02EDA4E4
Sleep.KERNEL32(00000000,?,02EDC2E9,02EDC4E0,00000000,localcfg,?,02EDC4E0,02EE3588,02ED8810), ref: 02EDA4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 02EDA4FA

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 0baca5e55062813d890238d29237af02e2b5780df74d9e61eae2daa185ba0416
Instruction ID: a345639be9fa10a8500931e39a06aa5b4438b76c8aea919ead62f95d1c3745bd
Opcode Fuzzy Hash: 0baca5e55062813d890238d29237af02e2b5780df74d9e61eae2daa185ba0416
Instruction Fuzzy Hash: 15E026332C020497CA0017A6EC84FAA3398EB89761F418831FA04E7240D696A69285B6

Function 02ED4E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02ED4E9E
GetTickCount.KERNEL32 ref: 02ED4EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 02ED4EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 02ED4EC3

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 80927fca17c04bee2c9e6cc8c9f264e832b27cc29f8270d8e7c7021ae98bfc29
Instruction ID: 01e21cdc1bb38b6d5e50e431480ce5294eb34a5a6648ba2d0f22191d4af1813a
Opcode Fuzzy Hash: 80927fca17c04bee2c9e6cc8c9f264e832b27cc29f8270d8e7c7021ae98bfc29
Instruction Fuzzy Hash: FFE086326C1214A7DA1026BAEC84F5776999B95371F410D31FA09EA1C0D6A7A49345B1

Function 02ED30FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02ED3103
GetTickCount.KERNEL32 ref: 02ED310F
Sleep.KERNEL32(00000000), ref: 02ED311C
InterlockedExchange.KERNEL32(?,00000001), ref: 02ED3128

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: f2323871047479aec9d8efa5890607213cc9373c576c6a02ed59c808c0fd0424
Instruction ID: 2dbbb42939f031c951c6ecc82dead9941b057345ec93f3d26ec952949e4913a8
Opcode Fuzzy Hash: f2323871047479aec9d8efa5890607213cc9373c576c6a02ed59c808c0fd0424
Instruction Fuzzy Hash: 01E0C2366C0216EBDF102BB6EE45B896B5AEF847A1F416C71F201EA090C69048528D72

Function 02ED8CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02ED8D02
GetTickCount.KERNEL32 ref: 02ED8DA1

Strings

localcfg, xrefs: 02ED8D19

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: abef8006fa9413fa620a1fe1832cf520c9fc8d0724bcd6744fc317b212d3ad5f
Instruction ID: 64ea041b5efc189d175a3c45a1fe087aa30daaeaf0a16cc3859c64271fba8d46
Opcode Fuzzy Hash: abef8006fa9413fa620a1fe1832cf520c9fc8d0724bcd6744fc317b212d3ad5f
Instruction Fuzzy Hash: 4C21E732A90515EFCF10DFB5C88196A77BEFF62318B65A499E401DB581CB30E943CB50

Function 02EDBFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02EDBFD0
wsprintfA.USER32 ref: 02EDC060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 02EDC057

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 24f743bacb900bd4c3661d3f1092aeadc496ca307540925bba361301f40c58d1
Instruction ID: 16b51550cac66dbe09dc9b9298d3bc98291045a467fd04d71469c9370796e131
Opcode Fuzzy Hash: 24f743bacb900bd4c3661d3f1092aeadc496ca307540925bba361301f40c58d1
Instruction Fuzzy Hash: 00119772540100FFDB429AA9CD44E567FA6FF88318B34959CF6188E126D633D863EB50

Function 02ED38F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED30FA: GetTickCount.KERNEL32 ref: 02ED3103
Part of subcall function 02ED30FA: InterlockedExchange.KERNEL32(?,00000001), ref: 02ED3128

GetCurrentThreadId.KERNEL32 ref: 02ED3929
GetCurrentThreadId.KERNEL32 ref: 02ED3939

Strings

%FROM_EMAIL, xrefs: 02ED3913

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 026402a983616bacfc26ed0329cd2bc334a5f7eacb433b5088f2188581d7e27c
Instruction ID: 1a5b2cccd35e3238b258a0a948bc8bbb39e30deecf9a7dbc852326aaaa1f3312
Opcode Fuzzy Hash: 026402a983616bacfc26ed0329cd2bc334a5f7eacb433b5088f2188581d7e27c
Instruction Fuzzy Hash: 3F113D71980204EFDB20DF1AD481A58F3F5FB04715F50D99EED459B285C770AA82CFA1

Function 02EDAB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,02EDBD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 02EDABB9
InterlockedIncrement.KERNEL32(02EE3640), ref: 02EDABE1

Strings

%FROM_EMAIL, xrefs: 02EDAB8C

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: a9023a2d46cef322bc82ff9413dcad3094e38653d247d02aba34f2853872ce3e
Instruction ID: 5297f851d99bfb3daf912ecda0e1bf0fea5431dd4b8bf7454d7ca2e0f82ef2d7
Opcode Fuzzy Hash: a9023a2d46cef322bc82ff9413dcad3094e38653d247d02aba34f2853872ce3e
Instruction Fuzzy Hash: 11019271588284AFEF11CE18D891F957BA6AF45314F149894F5805B302C3B0E786CBA0

Function 02ED26B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 02ED26C3
inet_ntoa.WS2_32(?), ref: 02ED26E4

Strings

localcfg, xrefs: 02ED26CD, 02ED26D2, 02ED26DE

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 2490427343fec07d47bee98683704c7e78aeeab6c1628c42e17486d19df146c3
Instruction ID: 47b71e36a7ee355c43508d54d5b2f7f5c2244356fbafad6d83b6d7a801ea40f0
Opcode Fuzzy Hash: 2490427343fec07d47bee98683704c7e78aeeab6c1628c42e17486d19df146c3
Instruction Fuzzy Hash: F9F082361C8309AFEF006EA0EC09AAA379CDB09254F14C421FA18DE091DBB1D9518798

Function 02EDEAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,02EDEB54,_alldiv,02EDF0B7,80000001,00000000,00989680,00000000,?,?,?,02EDE342,00000000,7597EA50,80000001,00000000), ref: 02EDEAF2
GetProcAddress.KERNEL32(77600000,00000000), ref: 02EDEB07

Strings

ntdll.dll, xrefs: 02EDEAED

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 01ad8388ee342ea5f7d294a946e6690fcf12c8a1a353123691090c52016e98b1
Instruction ID: 63909a49d7c745c934a92f526c9349d4e5cb6f3d1f0a1473d5f67121cd938ac8
Opcode Fuzzy Hash: 01ad8388ee342ea5f7d294a946e6690fcf12c8a1a353123691090c52016e98b1
Instruction Fuzzy Hash: CDD0C978AC0303DB9F32CFB6D91EA2677E8AB44706BC09855B40BEE100E774E4E5DA10

Function 02ED2F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02ED2D21: GetModuleHandleA.KERNEL32(00000000,774D23A0,?,00000000,02ED2F01,?,02ED20FF,02EE2000), ref: 02ED2D3A
Part of subcall function 02ED2D21: LoadLibraryA.KERNEL32(?), ref: 02ED2D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02ED2F73
HeapFree.KERNEL32(00000000), ref: 02ED2F7A

Memory Dump Source

Source File: 00000013.00000002.2528935050.0000000002ED0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02ED0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2ed0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: f332c5db67a9356283509a40c5ca38b25c5af0345894c40c95985b973a65d7c5
Instruction ID: f3a6d2720c3fb12518a87ed0eb2b75f4e52663d858eae9d8eeccc1104183b0be
Opcode Fuzzy Hash: f332c5db67a9356283509a40c5ca38b25c5af0345894c40c95985b973a65d7c5
Instruction Fuzzy Hash: 7F51AD7194020AEFCF019F64D888AFAB775FF05304F1495A9ED96DB210E7329A1ACF90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ODy57hA4Su.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

C:\Users\user\AppData\Local\Temp\jhrsuqtz.exe

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

C:\Windows\SysWOW64\puwycifc\jhrsuqtz.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
ODy57hA4Su.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre