Edit tour
Windows
Analysis Report
RSno9EH0K9.exe
Overview
General Information
| Sample name: | RSno9EH0K9.exe |
| Analysis ID: | 1505683 |
| MD5: | 8e456f932787fcd0cadbb598174575b2 |
| SHA1: | 22b069c76b86bdb6be8cdafc78019b55c583062e |
| SHA256: | c55859f35ad07e3e4b13f45fa5fa4c788f7059daac930ea435600a936104c1b5 |
| Tags: | exe |
| Infos: |   |
 | |
Detection
Tofsee
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected Tofsee
AI detected suspicious sample
Adds extensions / path to Windows Defender exclusion list (Registry)
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Drops executables to the windows directory (C:\Windows) and starts them
Found API chain indicative of debugger detection
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the windows firewall
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious New Service Creation
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Abnormal high CPU Usage
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query network adapater information
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found evaded block containing many API calls
Found evasive API chain (date check)
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: Windows Defender Exclusions Added - Registry
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara signature match
Classification
- System is w10x64
RSno9EH0K9.exe (PID: 7552 cmdline: "C:\Users\ user\Deskt op\RSno9EH 0K9.exe" MD5: 8E456F932787FCD0CADBB598174575B2) 
cmd.exe (PID: 7632 cmdline: "C:\Window s\System32 \cmd.exe" /C mkdir C :\Windows\ SysWOW64\g xtfamnt\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7640 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7688 cmdline:
"C:\Window s\System32 \cmd.exe" /C move /Y "C:\Users \user\AppD ata\Local\ Temp\nutgo owa.exe" C :\Windows\ SysWOW64\g xtfamnt\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7696 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
sc.exe (PID: 7736 cmdline: "C:\Window s\System32 \sc.exe" c reate gxtf amnt binPa th= "C:\Wi ndows\SysW OW64\gxtfa mnt\nutgoo wa.exe /d\ "C:\Users\ user\Deskt op\RSno9EH 0K9.exe\"" type= own start= au to Display Name= "wif i support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8) - conhost.exe (PID: 7744 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 7784 cmdline:
"C:\Window s\System32 \sc.exe" d escription gxtfamnt "wifi inte rnet conec tion" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8) - conhost.exe (PID: 7792 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 7860 cmdline:
"C:\Window s\System32 \sc.exe" s tart gxtfa mnt MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8) - conhost.exe (PID: 7868 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - netsh.exe (PID: 7932 cmdline:
"C:\Window s\System32 \netsh.exe " advfirew all firewa ll add rul e name="Ho st-process for servi ces of Win dows" dir= in action= allow prog ram="C:\Wi ndows\SysW OW64\svcho st.exe" en able=yes>n ul MD5: 4E89A1A088BE715D6C946E55AB07C7DF) - conhost.exe (PID: 7940 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- nutgoowa.exe (PID: 7912 cmdline:
C:\Windows \SysWOW64\ gxtfamnt\n utgoowa.ex e /d"C:\Us ers\user\D esktop\RSn o9EH0K9.ex e" MD5: 834E2E11D20A334B04B409E9ECD91E76) - svchost.exe (PID: 7292 cmdline:
svchost.ex e MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Tofsee | According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems. | No Attribution |
{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| Windows_Trojan_RedLineStealer_ed346e4c | unknown | unknown |
| |
| JoeSecurity_Tofsee | Yara detected Tofsee | Joe Security | ||
| Windows_Trojan_Tofsee_26124fe4 | unknown | unknown |
| |
| MALWARE_Win_Tofsee | Detects Tofsee | ditekSHen |
| |
| JoeSecurity_Tofsee | Yara detected Tofsee | Joe Security | ||
| Click to see the 24 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| Windows_Trojan_Tofsee_26124fe4 | unknown | unknown |
| |
| MALWARE_Win_Tofsee | Detects Tofsee | ditekSHen |
| |
| JoeSecurity_Tofsee | Yara detected Tofsee | Joe Security | ||
| Windows_Trojan_Tofsee_26124fe4 | unknown | unknown |
| |
| MALWARE_Win_Tofsee | Detects Tofsee | ditekSHen |
| |
| Click to see the 39 entries | ||||
System Summary |   |
|---|
| Source: | Author: David Burkett, @signalblur: | ||
| Source: | Author: Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: frack113: | ||
| Source: | Author: Florian Roth (Nextron Systems): | ||
| Source: | Author: Christian Burkard (Nextron Systems): | ||
| Source: | Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
Compliance | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Static PE information: | ||
| Source: | File opened: | Jump to behavior | ||
Change of critical system settings | |
|---|
| Source: | Registry key created or modified: | Jump to behavior | ||
Networking | |
|---|
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | ASN Name: | ||
| Source: | ASN Name: | ||
| Source: | ASN Name: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_00402A62 | |
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
Spam, unwanted Advertisements and Ransom Demands | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_00408E26 | |
| Source: | Code function: | 0_2_00401280 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_0040C913 | |
| Source: | Code function: | 0_2_0041A3E0 | |
| Source: | Code function: | 11_2_0040C913 | |
| Source: | Code function: | 11_2_0041A3E0 | |
| Source: | Code function: | 11_2_00533750 | |
| Source: | Code function: | 17_2_0050C913 | |
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00406A60 | |
| Source: | Code function: | 0_2_0055C02E | |
| Source: | Code function: | 0_2_00409A6B | |
| Source: | Code function: | 0_2_00409A6B | |
| Source: | Code function: | 11_2_00409A6B | |
| Source: | Code function: | 17_2_00509A6B | |
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Evasive API call chain: | graph_11-15085 | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
Data Obfuscation | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Code function: | 0_2_00406069 | |
| Source: | Code function: | 0_2_0055F31C | |
| Source: | Code function: | 11_2_0053779C | |
| Source: | Static PE information: | ||
Persistence and Installation Behavior | |
|---|
| Source: | Executable created and started: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | Registry key value modified: | Jump to behavior | ||
| Source: | Code function: | 0_2_00409A6B | |
| Source: | Process created: | ||
| Source: | Code function: | 0_2_00401000 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Code function: | 17_2_0050199C | |
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Decision node followed by non-executed suspicious API: | graph_11-15510 | ||
| Source: | Decision node followed by non-executed suspicious API: | graph_0-16068 | ||
| Source: | Decision node followed by non-executed suspicious API: | graph_17-6485 | ||
| Source: | Evaded block: | graph_17-6156 | ||
| Source: | Evasive API call chain: | graph_0-15410 | ||
| Source: | Evasive API call chain: | graph_17-7343 | ||
| Source: | Evasive API call chain: | graph_11-15461 | ||
| Source: | Evasive API call chain: | graph_17-7459 | ||
| Source: | Evasive API call chain: | graph_17-6186 | ||
| Source: | Evasive API call chain: | graph_11-15101 | ||
| Source: | Evasive API call chain: | graph_0-14993 | ||
| Source: | API coverage: | ||
| Source: | API coverage: | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_0041A3E0 | |
| Source: | Code function: | 11_2_0041A3E0 | |
| Source: | Code function: | 0_2_00401D96 | |
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-15422 | ||
| Source: | API call chain: | graph_11-15471 | ||
| Source: | API call chain: | graph_17-6187 | ||
Anti Debugging | |
|---|
| Source: | Debugger detection routine: | graph_17-7681 | ||
| Source: | Code function: | 0_2_00406069 | |
| Source: | Code function: | 0_2_0055B90B | |
| Source: | Code function: | 0_2_0207092B | |
| Source: | Code function: | 0_2_02070D90 | |
| Source: | Code function: | 11_2_0050092B | |
| Source: | Code function: | 11_2_00500D90 | |
| Source: | Code function: | 11_2_00533D8B | |
| Source: | Code function: | 0_2_0040EBCC | |
| Source: | Code function: | 0_2_00409A6B | |
| Source: | Code function: | 11_2_00409A6B | |
| Source: | Code function: | 17_2_00509A6B | |
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Network Connect: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00407809 | |
| Source: | Code function: | 0_2_00406EDD | |
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_0040405E | |
| Source: | Code function: | 0_2_0040EC54 | |
| Source: | Code function: | 0_2_00407809 | |
| Source: | Code function: | 0_2_0040B211 | |
| Source: | Code function: | 0_2_00409326 | |
Lowering of HIPS / PFW / Operating System Security Settings | |
|---|
| Source: | Process created: | ||
| Source: | Process created: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Code function: | 0_2_004088B0 | |
| Source: | Code function: | 11_2_004088B0 | |
| Source: | Code function: | 17_2_005088B0 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 1 Valid Accounts | 41 Native API | 1 DLL Side-Loading | 1 DLL Side-Loading | 3 Disable or Modify Tools | OS Credential Dumping | 12 System Time Discovery | Remote Services | 1 Archive Collected Data | 1 Ingress Tool Transfer | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 2 Command and Scripting Interpreter | 1 Valid Accounts | 1 Valid Accounts | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | Data from Removable Media | 12 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | 3 Service Execution | 14 Windows Service | 1 Access Token Manipulation | 3 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 14 Windows Service | 22 Software Packing | NTDS | 15 System Information Discovery | Distributed Component Object Model | Input Capture | 112 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 412 Process Injection | 1 DLL Side-Loading | LSA Secrets | 111 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 12 Masquerading | Cached Domain Credentials | 11 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Valid Accounts | DCSync | 1 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 11 Virtualization/Sandbox Evasion | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 1 Access Token Manipulation | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
| IP Addresses | Compromise Infrastructure | Supply Chain Compromise | PowerShell | Cron | Cron | 412 Process Injection | Network Sniffing | 1 System Network Configuration Discovery | Shared Webroot | Local Data Staging | File Transfer Protocols | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | External Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 29% | ReversingLabs | |||
| 100% | Avira | HEUR/AGEN.1312567 | ||
| 100% | Joe Sandbox ML |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | HEUR/AGEN.1312567 | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | phishing |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| mxs.mail.ru | 217.69.139.150 | true | true | unknown | |
| mta7.am0.yahoodns.net | 67.195.228.111 | true | true | unknown | |
| jotunheim.name | 80.66.75.11 | true | true | unknown | |
| microsoft-com.mail.protection.outlook.com | 52.101.8.49 | true | true | unknown | |
| vanaheim.cn | 77.232.41.29 | true | true | unknown | |
| smtp.google.com | 64.233.166.26 | true | false | unknown | |
| google.com | unknown | unknown | true | unknown | |
| yahoo.com | unknown | unknown | true | unknown | |
| mail.ru | unknown | unknown | true | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown | |
| true |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 52.101.11.0 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | true | |
| 67.195.228.109 | unknown | United States | 36647 | YAHOO-GQ1US | true | |
| 64.233.166.26 | smtp.google.com | United States | 15169 | GOOGLEUS | false | |
| 52.101.8.49 | microsoft-com.mail.protection.outlook.com | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | true | |
| 217.69.139.150 | mxs.mail.ru | Russian Federation | 47764 | MAILRU-ASMailRuRU | true | |
| 67.195.228.111 | mta7.am0.yahoodns.net | United States | 36647 | YAHOO-GQ1US | true | |
| 77.232.41.29 | vanaheim.cn | Russian Federation | 28968 | EUT-ASEUTIPNetworkRU | true | |
| 80.66.75.11 | jotunheim.name | Russian Federation | 20803 | RISS-ASRU | true |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1505683 |
| Start date and time: | 2024-09-06 16:34:49 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 8m 35s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 19 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | RSno9EH0K9.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@22/3@12/8 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded IPs from analysis (whitelisted): 20.76.201.171, 20.112.250.133, 20.70.246.20, 20.231.239.246, 20.236.44.162
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtEnumerateKey calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: RSno9EH0K9.exe
| Time | Type | Description |
|---|---|---|
| 10:37:01 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 52.101.11.0 | Get hash | malicious | Tofsee | Browse | ||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| 67.195.228.109 | Get hash | malicious | Tofsee | Browse | ||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Phorpiex | Browse | |||
| Get hash | malicious | Phorpiex | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Phorpiex | Browse | |||
| Get hash | malicious | Phorpiex, Xmrig | Browse | |||
| Get hash | malicious | Phorpiex | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| 52.101.8.49 | Get hash | malicious | Tofsee | Browse | ||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| 217.69.139.150 | Get hash | malicious | Tofsee | Browse | ||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse | |||
| Get hash | malicious | Tofsee | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| mta7.am0.yahoodns.net | Get hash | malicious | Tofsee | Browse |
| |
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Phorpiex | Browse |
| ||
| jotunheim.name | Get hash | malicious | Tofsee | Browse |
| |
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| mxs.mail.ru | Get hash | malicious | Tofsee | Browse |
| |
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| YAHOO-GQ1US | Get hash | malicious | Tofsee | Browse |
| |
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Mirai, Moobot | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai, Moobot, Okiru | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| MAILRU-ASMailRuRU | Get hash | malicious | Tofsee | Browse |
| |
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Tofsee | Browse |
| ||
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | DBatLoader, FormBook | Browse |
| |
| Get hash | malicious | DBatLoader, FormBook | Browse |
| ||
| Get hash | malicious | DBatLoader | Browse |
| ||
| Get hash | malicious | DBatLoader | Browse |
| ||
| Get hash | malicious | DBatLoader | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | DBatLoader, FormBook | Browse |
| |
| Get hash | malicious | DBatLoader, FormBook | Browse |
| ||
| Get hash | malicious | DBatLoader | Browse |
| ||
| Get hash | malicious | DBatLoader | Browse |
| ||
| Get hash | malicious | DBatLoader | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
⊘No context
| Process: | C:\Users\user\Desktop\RSno9EH0K9.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 12841984 |
| Entropy (8bit): | 5.51719875100034 |
| Encrypted: | false |
| SSDEEP: | 49152:ELaRlaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaH:E |
| MD5: | 834E2E11D20A334B04B409E9ECD91E76 |
| SHA1: | 0E5B9A794295B9B1CC67603927570F9A4A95E699 |
| SHA-256: | 3A9E733A24B8A531658A22F1CADFF184693A125A31E009964042BABF40ACB096 |
| SHA-512: | 13BCA226E7139B602DDA6DE8BEF9424E4B5B177FC03CC95F409170CE6DD13CAFEF387EF638731B1AFD1B61E42EA8F98DE0FB29E9ECD6091C0CAB00B8511A89C8 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Windows\SysWOW64\cmd.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 12841984 |
| Entropy (8bit): | 5.51719875100034 |
| Encrypted: | false |
| SSDEEP: | 49152:ELaRlaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaH:E |
| MD5: | 834E2E11D20A334B04B409E9ECD91E76 |
| SHA1: | 0E5B9A794295B9B1CC67603927570F9A4A95E699 |
| SHA-256: | 3A9E733A24B8A531658A22F1CADFF184693A125A31E009964042BABF40ACB096 |
| SHA-512: | 13BCA226E7139B602DDA6DE8BEF9424E4B5B177FC03CC95F409170CE6DD13CAFEF387EF638731B1AFD1B61E42EA8F98DE0FB29E9ECD6091C0CAB00B8511A89C8 |
| Malicious: | true |
| Preview: |
| Process: | C:\Windows\SysWOW64\netsh.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3773 |
| Entropy (8bit): | 4.7109073551842435 |
| Encrypted: | false |
| SSDEEP: | 48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w |
| MD5: | DA3247A302D70819F10BCEEBAF400503 |
| SHA1: | 2857AA198EE76C86FC929CC3388A56D5FD051844 |
| SHA-256: | 5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8 |
| SHA-512: | 48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.567618045686162 |
| TrID: |
|
| File name: | RSno9EH0K9.exe |
| File size: | 218'112 bytes |
| MD5: | 8e456f932787fcd0cadbb598174575b2 |
| SHA1: | 22b069c76b86bdb6be8cdafc78019b55c583062e |
| SHA256: | c55859f35ad07e3e4b13f45fa5fa4c788f7059daac930ea435600a936104c1b5 |
| SHA512: | cb26a33dacdcfe804bdd587ecd44b9bf1c59f357e8701fc4f5e1b04d8d8882466c7743fac51969fe8912e1197a5653986eb4a71edc35eee89051b6c98d546c9d |
| SSDEEP: | 6144:MGDLD6Tj3Vyg0mwiRjaVlodEFjvn/Mq0Vdh1HQ:M+L2n3VygtzRWJjv+Vdz |
| TLSH: | DA246A1476EF9026EEA7C7340A73D6B1192ABC626EB442BF3294371E2933FD34954352 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........?G..lG..lG..l..QlF..l(.bl^..l(.WlU..l(.cl"..lN.ZlB..lG..l7..l(.flF..l(.SlF..l(.TlF..lRichG..l........................PE..L.. |
 | |
| Icon Hash: | 738733b18ba383e4 |
| Entrypoint: | 0x401a87 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x64B12892 [Fri Jul 14 10:50:58 2023 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 4466917f30d072b6b108006d1bc57b5b |
| Instruction |
|---|
| call 00007FDBA07D9AD2h |
| jmp 00007FDBA07D565Eh |
| mov edi, edi |
| push ebp |
| mov ebp, esp |
| sub esp, 00000328h |
| mov dword ptr [0041FAF0h], eax |
| mov dword ptr [0041FAECh], ecx |
| mov dword ptr [0041FAE8h], edx |
| mov dword ptr [0041FAE4h], ebx |
| mov dword ptr [0041FAE0h], esi |
| mov dword ptr [0041FADCh], edi |
| mov word ptr [0041FB08h], ss |
| mov word ptr [0041FAFCh], cs |
| mov word ptr [0041FAD8h], ds |
| mov word ptr [0041FAD4h], es |
| mov word ptr [0041FAD0h], fs |
| mov word ptr [0041FACCh], gs |
| pushfd |
| pop dword ptr [0041FB00h] |
| mov eax, dword ptr [ebp+00h] |
| mov dword ptr [0041FAF4h], eax |
| mov eax, dword ptr [ebp+04h] |
| mov dword ptr [0041FAF8h], eax |
| lea eax, dword ptr [ebp+08h] |
| mov dword ptr [0041FB04h], eax |
| mov eax, dword ptr [ebp-00000320h] |
| mov dword ptr [0041FA40h], 00010001h |
| mov eax, dword ptr [0041FAF8h] |
| mov dword ptr [0041F9F4h], eax |
| mov dword ptr [0041F9E8h], C0000409h |
| mov dword ptr [0041F9ECh], 00000001h |
| mov eax, dword ptr [0041E004h] |
| mov dword ptr [ebp-00000328h], eax |
| mov eax, dword ptr [0041E008h] |
| mov dword ptr [ebp-00000324h], eax |
| call dword ptr [000000E4h] |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x1ce14 | 0x3c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x25000 | 0x16e40 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x1b000 | 0x190 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x197df | 0x19800 | 36d9d8ad2432bc42e1160ebd5b09c3b2 | False | 0.7763576133578431 | data | 7.427995980269359 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x1b000 | 0x273e | 0x2800 | 9509e792c5338f4b9f36a8ec0ea34ebf | False | 0.34833984375 | data | 4.957858747827386 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x1e000 | 0x6240 | 0x2000 | b95cebcf35f1df9c373b6fe28605ab02 | False | 0.1845703125 | data | 2.1279534319819424 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x25000 | 0x16e40 | 0x17000 | 28390e7f44a74628179815dad390dc7a | False | 0.480521824048913 | data | 5.492921090492436 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| AFX_DIALOG_LAYOUT | 0x36ba8 | 0x2 | data | 5.0 | ||
| KADORUN | 0x35b88 | 0xbf7 | ASCII text, with very long lines (3063), with no line terminators | Turkish | Turkey | 0.6020241593209272 |
| SIFUKOCUZEYORA | 0x36780 | 0x3fa | ASCII text, with very long lines (1018), with no line terminators | Turkish | Turkey | 0.6277013752455796 |
| RT_CURSOR | 0x36bb0 | 0x130 | Device independent bitmap graphic, 32 x 64 x 1, image size 0 | 0.7368421052631579 | ||
| RT_CURSOR | 0x36ce0 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | 0.06130705394190871 | ||
| RT_ICON | 0x25950 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | Turkish | Turkey | 0.5868869936034116 |
| RT_ICON | 0x267f8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | Turkish | Turkey | 0.6606498194945848 |
| RT_ICON | 0x270a0 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors | Turkish | Turkey | 0.7194700460829493 |
| RT_ICON | 0x27768 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | Turkish | Turkey | 0.7622832369942196 |
| RT_ICON | 0x27cd0 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9216 | Turkish | Turkey | 0.5440871369294605 |
| RT_ICON | 0x2a278 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4096 | Turkish | Turkey | 0.6597091932457786 |
| RT_ICON | 0x2b320 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2304 | Turkish | Turkey | 0.6782786885245902 |
| RT_ICON | 0x2bca8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1024 | Turkish | Turkey | 0.8023049645390071 |
| RT_ICON | 0x2c188 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | Turkish | Turkey | 0.3494136460554371 |
| RT_ICON | 0x2d030 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | Turkish | Turkey | 0.5500902527075813 |
| RT_ICON | 0x2d8d8 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 0 | Turkish | Turkey | 0.6244239631336406 |
| RT_ICON | 0x2dfa0 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | Turkish | Turkey | 0.6791907514450867 |
| RT_ICON | 0x2e508 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | Turkish | Turkey | 0.4262448132780083 |
| RT_ICON | 0x30ab0 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 0 | Turkish | Turkey | 0.5200819672131147 |
| RT_ICON | 0x31438 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | Turkish | Turkey | 0.5079787234042553 |
| RT_ICON | 0x31908 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | Turkish | Turkey | 0.4069829424307036 |
| RT_ICON | 0x327b0 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | Turkish | Turkey | 0.572202166064982 |
| RT_ICON | 0x33058 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 0 | Turkish | Turkey | 0.625 |
| RT_ICON | 0x33720 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | Turkish | Turkey | 0.630057803468208 |
| RT_ICON | 0x33c88 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 0 | Turkish | Turkey | 0.4643527204502814 |
| RT_ICON | 0x34d30 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 0 | Turkish | Turkey | 0.4504098360655738 |
| RT_ICON | 0x356b8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | Turkish | Turkey | 0.49556737588652483 |
| RT_DIALOG | 0x39460 | 0x84 | data | 0.7651515151515151 | ||
| RT_STRING | 0x394e8 | 0x362 | data | 0.4653579676674365 | ||
| RT_STRING | 0x39850 | 0x54e | data | 0.4418262150220913 | ||
| RT_STRING | 0x39da0 | 0xa0 | data | 0.61875 | ||
| RT_STRING | 0x39e40 | 0x8ca | data | 0.41244444444444445 | ||
| RT_STRING | 0x3a710 | 0x8ec | data | 0.4106830122591944 | ||
| RT_STRING | 0x3b000 | 0x8b0 | data | 0.4123201438848921 | ||
| RT_STRING | 0x3b8b0 | 0x4fe | data | 0.44209702660406885 | ||
| RT_STRING | 0x3bdb0 | 0x8e | data | 0.6056338028169014 | ||
| RT_ACCELERATOR | 0x36b80 | 0x28 | data | 1.025 | ||
| RT_GROUP_CURSOR | 0x39288 | 0x22 | data | 1.088235294117647 | ||
| RT_GROUP_ICON | 0x318a0 | 0x68 | data | Turkish | Turkey | 0.7019230769230769 |
| RT_GROUP_ICON | 0x2c110 | 0x76 | data | Turkish | Turkey | 0.6610169491525424 |
| RT_GROUP_ICON | 0x35b20 | 0x68 | data | Turkish | Turkey | 0.7211538461538461 |
| RT_VERSION | 0x392b0 | 0x1ac | data | 0.5864485981308412 |
| DLL | Import |
|---|---|
| KERNEL32.dll | FillConsoleOutputCharacterA, GetConsoleAliasesLengthW, GetNumaProcessorNode, DebugActiveProcessStop, GetDefaultCommConfigW, CallNamedPipeA, WriteConsoleOutputW, HeapAlloc, InterlockedDecrement, GlobalSize, GetEnvironmentStringsW, CreateDirectoryW, GetComputerNameW, GetSystemDefaultLCID, GetModuleHandleW, GetCommandLineA, GetSystemTimes, GlobalAlloc, LoadLibraryW, GetConsoleAliasExesLengthW, SetConsoleMode, GetFileAttributesW, GetBinaryTypeA, GetStartupInfoW, SetConsoleTitleA, GetShortPathNameA, InterlockedExchange, GetLastError, GetProcAddress, CopyFileA, SetStdHandle, EnterCriticalSection, SearchPathA, BuildCommDCBW, GetNumaHighestNodeNumber, OpenWaitableTimerA, LoadLibraryA, UnhandledExceptionFilter, WritePrivateProfileStringA, QueryDosDeviceW, VirtualLock, FoldStringW, GetModuleFileNameA, FreeEnvironmentStringsW, FindAtomW, CopyFileExA, SetFilePointer, WriteConsoleW, EncodePointer, DecodePointer, MultiByteToWideChar, ExitProcess, GetCommandLineW, HeapSetInformation, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, IsDebuggerPresent, WriteFile, GetStdHandle, GetModuleFileNameW, HeapCreate, LeaveCriticalSection, Sleep, HeapSize, GetCPInfo, InterlockedIncrement, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, HeapFree, RtlUnwind, HeapReAlloc, WideCharToMultiByte, LCMapStringW, GetStringTypeW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, IsProcessorFeaturePresent, ReadFile, CloseHandle, CreateFileW |
| USER32.dll | GetUserObjectInformationW |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Turkish | Turkey |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Sep 6, 2024 16:36:19.227689028 CEST | 49737 | 25 | 192.168.2.4 | 52.101.8.49 |
| Sep 6, 2024 16:36:20.304121017 CEST | 49737 | 25 | 192.168.2.4 | 52.101.8.49 |
| Sep 6, 2024 16:36:22.217003107 CEST | 49738 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:36:22.217051983 CEST | 443 | 49738 | 77.232.41.29 | 192.168.2.4 |
| Sep 6, 2024 16:36:22.217109919 CEST | 49738 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:36:22.304138899 CEST | 49737 | 25 | 192.168.2.4 | 52.101.8.49 |
| Sep 6, 2024 16:36:26.304135084 CEST | 49737 | 25 | 192.168.2.4 | 52.101.8.49 |
| Sep 6, 2024 16:36:34.304133892 CEST | 49737 | 25 | 192.168.2.4 | 52.101.8.49 |
| Sep 6, 2024 16:36:39.241991043 CEST | 49740 | 25 | 192.168.2.4 | 67.195.228.111 |
| Sep 6, 2024 16:36:40.304153919 CEST | 49740 | 25 | 192.168.2.4 | 67.195.228.111 |
| Sep 6, 2024 16:36:42.304224014 CEST | 49740 | 25 | 192.168.2.4 | 67.195.228.111 |
| Sep 6, 2024 16:36:46.304169893 CEST | 49740 | 25 | 192.168.2.4 | 67.195.228.111 |
| Sep 6, 2024 16:36:54.319911957 CEST | 49740 | 25 | 192.168.2.4 | 67.195.228.111 |
| Sep 6, 2024 16:36:59.273736954 CEST | 49741 | 25 | 192.168.2.4 | 64.233.166.26 |
| Sep 6, 2024 16:37:00.272990942 CEST | 49741 | 25 | 192.168.2.4 | 64.233.166.26 |
| Sep 6, 2024 16:37:02.210690975 CEST | 49738 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:37:02.210777998 CEST | 443 | 49738 | 77.232.41.29 | 192.168.2.4 |
| Sep 6, 2024 16:37:02.210845947 CEST | 49738 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:37:02.272945881 CEST | 49741 | 25 | 192.168.2.4 | 64.233.166.26 |
| Sep 6, 2024 16:37:02.321695089 CEST | 49742 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:37:02.321727037 CEST | 443 | 49742 | 77.232.41.29 | 192.168.2.4 |
| Sep 6, 2024 16:37:02.321809053 CEST | 49742 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:37:06.275820017 CEST | 49741 | 25 | 192.168.2.4 | 64.233.166.26 |
| Sep 6, 2024 16:37:14.272963047 CEST | 49741 | 25 | 192.168.2.4 | 64.233.166.26 |
| Sep 6, 2024 16:37:19.291198015 CEST | 49743 | 25 | 192.168.2.4 | 217.69.139.150 |
| Sep 6, 2024 16:37:20.304311037 CEST | 49743 | 25 | 192.168.2.4 | 217.69.139.150 |
| Sep 6, 2024 16:37:22.319858074 CEST | 49743 | 25 | 192.168.2.4 | 217.69.139.150 |
| Sep 6, 2024 16:37:26.335516930 CEST | 49743 | 25 | 192.168.2.4 | 217.69.139.150 |
| Sep 6, 2024 16:37:34.351154089 CEST | 49743 | 25 | 192.168.2.4 | 217.69.139.150 |
| Sep 6, 2024 16:37:42.320031881 CEST | 49742 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:37:42.320127964 CEST | 443 | 49742 | 77.232.41.29 | 192.168.2.4 |
| Sep 6, 2024 16:37:42.320223093 CEST | 49742 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:37:42.430494070 CEST | 49744 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:37:42.430547953 CEST | 443 | 49744 | 77.232.41.29 | 192.168.2.4 |
| Sep 6, 2024 16:37:42.430615902 CEST | 49744 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:38:22.445233107 CEST | 49744 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:38:22.445314884 CEST | 443 | 49744 | 77.232.41.29 | 192.168.2.4 |
| Sep 6, 2024 16:38:22.445388079 CEST | 49744 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:38:22.558008909 CEST | 49745 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:38:22.558052063 CEST | 443 | 49745 | 77.232.41.29 | 192.168.2.4 |
| Sep 6, 2024 16:38:22.558140993 CEST | 49745 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:38:45.017765999 CEST | 49747 | 25 | 192.168.2.4 | 52.101.11.0 |
| Sep 6, 2024 16:38:46.023144007 CEST | 49747 | 25 | 192.168.2.4 | 52.101.11.0 |
| Sep 6, 2024 16:38:48.023159027 CEST | 49747 | 25 | 192.168.2.4 | 52.101.11.0 |
| Sep 6, 2024 16:38:52.025948048 CEST | 49747 | 25 | 192.168.2.4 | 52.101.11.0 |
| Sep 6, 2024 16:39:00.023185015 CEST | 49747 | 25 | 192.168.2.4 | 52.101.11.0 |
| Sep 6, 2024 16:39:02.570230961 CEST | 49745 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:39:02.570333958 CEST | 443 | 49745 | 77.232.41.29 | 192.168.2.4 |
| Sep 6, 2024 16:39:02.570409060 CEST | 49745 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:39:02.680423021 CEST | 49748 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:39:02.680466890 CEST | 443 | 49748 | 77.232.41.29 | 192.168.2.4 |
| Sep 6, 2024 16:39:02.680572987 CEST | 49748 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:39:05.016047001 CEST | 49749 | 25 | 192.168.2.4 | 67.195.228.109 |
| Sep 6, 2024 16:39:06.023238897 CEST | 49749 | 25 | 192.168.2.4 | 67.195.228.109 |
| Sep 6, 2024 16:39:08.023399115 CEST | 49749 | 25 | 192.168.2.4 | 67.195.228.109 |
| Sep 6, 2024 16:39:12.023236990 CEST | 49749 | 25 | 192.168.2.4 | 67.195.228.109 |
| Sep 6, 2024 16:39:20.023233891 CEST | 49749 | 25 | 192.168.2.4 | 67.195.228.109 |
| Sep 6, 2024 16:39:25.024322033 CEST | 49750 | 25 | 192.168.2.4 | 64.233.166.26 |
| Sep 6, 2024 16:39:26.023216963 CEST | 49750 | 25 | 192.168.2.4 | 64.233.166.26 |
| Sep 6, 2024 16:39:28.023300886 CEST | 49750 | 25 | 192.168.2.4 | 64.233.166.26 |
| Sep 6, 2024 16:39:32.023252010 CEST | 49750 | 25 | 192.168.2.4 | 64.233.166.26 |
| Sep 6, 2024 16:39:40.023271084 CEST | 49750 | 25 | 192.168.2.4 | 64.233.166.26 |
| Sep 6, 2024 16:39:42.679929018 CEST | 49748 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:39:42.680027962 CEST | 443 | 49748 | 77.232.41.29 | 192.168.2.4 |
| Sep 6, 2024 16:39:42.680130959 CEST | 49748 | 443 | 192.168.2.4 | 77.232.41.29 |
| Sep 6, 2024 16:39:42.896025896 CEST | 49751 | 443 | 192.168.2.4 | 80.66.75.11 |
| Sep 6, 2024 16:39:42.896078110 CEST | 443 | 49751 | 80.66.75.11 | 192.168.2.4 |
| Sep 6, 2024 16:39:42.896169901 CEST | 49751 | 443 | 192.168.2.4 | 80.66.75.11 |
| Sep 6, 2024 16:39:45.048800945 CEST | 49752 | 25 | 192.168.2.4 | 217.69.139.150 |
| Sep 6, 2024 16:39:46.054541111 CEST | 49752 | 25 | 192.168.2.4 | 217.69.139.150 |
| Sep 6, 2024 16:39:48.070254087 CEST | 49752 | 25 | 192.168.2.4 | 217.69.139.150 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Sep 6, 2024 16:36:19.168179035 CEST | 57004 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:36:19.203022957 CEST | 53 | 57004 | 1.1.1.1 | 192.168.2.4 |
| Sep 6, 2024 16:36:22.118668079 CEST | 59709 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:36:22.212795019 CEST | 53 | 59709 | 1.1.1.1 | 192.168.2.4 |
| Sep 6, 2024 16:36:39.226639986 CEST | 53201 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:36:39.233649969 CEST | 53 | 53201 | 1.1.1.1 | 192.168.2.4 |
| Sep 6, 2024 16:36:39.234272957 CEST | 56894 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:36:39.241333008 CEST | 53 | 56894 | 1.1.1.1 | 192.168.2.4 |
| Sep 6, 2024 16:36:59.257884026 CEST | 54271 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:36:59.265661001 CEST | 53 | 54271 | 1.1.1.1 | 192.168.2.4 |
| Sep 6, 2024 16:36:59.266172886 CEST | 57764 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:36:59.273264885 CEST | 53 | 57764 | 1.1.1.1 | 192.168.2.4 |
| Sep 6, 2024 16:37:19.273688078 CEST | 61009 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:37:19.281508923 CEST | 53 | 61009 | 1.1.1.1 | 192.168.2.4 |
| Sep 6, 2024 16:37:19.282929897 CEST | 54555 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:37:19.290666103 CEST | 53 | 54555 | 1.1.1.1 | 192.168.2.4 |
| Sep 6, 2024 16:38:44.767280102 CEST | 61890 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:38:45.017087936 CEST | 53 | 61890 | 1.1.1.1 | 192.168.2.4 |
| Sep 6, 2024 16:39:05.008553028 CEST | 57796 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:39:05.015393019 CEST | 53 | 57796 | 1.1.1.1 | 192.168.2.4 |
| Sep 6, 2024 16:39:42.790118933 CEST | 62966 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:39:42.895200968 CEST | 53 | 62966 | 1.1.1.1 | 192.168.2.4 |
| Sep 6, 2024 16:39:45.039819002 CEST | 60789 | 53 | 192.168.2.4 | 1.1.1.1 |
| Sep 6, 2024 16:39:45.048182964 CEST | 53 | 60789 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Sep 6, 2024 16:36:19.168179035 CEST | 192.168.2.4 | 1.1.1.1 | 0x9285 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 6, 2024 16:36:22.118668079 CEST | 192.168.2.4 | 1.1.1.1 | 0x243 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 6, 2024 16:36:39.226639986 CEST | 192.168.2.4 | 1.1.1.1 | 0x5ff7 | Standard query (0) | MX (Mail exchange) | IN (0x0001) | false | |
| Sep 6, 2024 16:36:39.234272957 CEST | 192.168.2.4 | 1.1.1.1 | 0x1133 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 6, 2024 16:36:59.257884026 CEST | 192.168.2.4 | 1.1.1.1 | 0xc79f | Standard query (0) | MX (Mail exchange) | IN (0x0001) | false | |
| Sep 6, 2024 16:36:59.266172886 CEST | 192.168.2.4 | 1.1.1.1 | 0xcec0 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 6, 2024 16:37:19.273688078 CEST | 192.168.2.4 | 1.1.1.1 | 0x6cd9 | Standard query (0) | MX (Mail exchange) | IN (0x0001) | false | |
| Sep 6, 2024 16:37:19.282929897 CEST | 192.168.2.4 | 1.1.1.1 | 0xceb2 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 6, 2024 16:38:44.767280102 CEST | 192.168.2.4 | 1.1.1.1 | 0x4eed | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 6, 2024 16:39:05.008553028 CEST | 192.168.2.4 | 1.1.1.1 | 0xd105 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 6, 2024 16:39:42.790118933 CEST | 192.168.2.4 | 1.1.1.1 | 0x9691 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 6, 2024 16:39:45.039819002 CEST | 192.168.2.4 | 1.1.1.1 | 0xdcc7 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Sep 6, 2024 16:36:19.203022957 CEST | 1.1.1.1 | 192.168.2.4 | 0x9285 | No error (0) | 52.101.8.49 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:19.203022957 CEST | 1.1.1.1 | 192.168.2.4 | 0x9285 | No error (0) | 52.101.11.0 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:19.203022957 CEST | 1.1.1.1 | 192.168.2.4 | 0x9285 | No error (0) | 52.101.42.0 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:19.203022957 CEST | 1.1.1.1 | 192.168.2.4 | 0x9285 | No error (0) | 52.101.40.26 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:22.212795019 CEST | 1.1.1.1 | 192.168.2.4 | 0x243 | No error (0) | 77.232.41.29 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:39.233649969 CEST | 1.1.1.1 | 192.168.2.4 | 0x5ff7 | No error (0) | MX (Mail exchange) | IN (0x0001) | false | |||
| Sep 6, 2024 16:36:39.233649969 CEST | 1.1.1.1 | 192.168.2.4 | 0x5ff7 | No error (0) | MX (Mail exchange) | IN (0x0001) | false | |||
| Sep 6, 2024 16:36:39.233649969 CEST | 1.1.1.1 | 192.168.2.4 | 0x5ff7 | No error (0) | MX (Mail exchange) | IN (0x0001) | false | |||
| Sep 6, 2024 16:36:39.241333008 CEST | 1.1.1.1 | 192.168.2.4 | 0x1133 | No error (0) | 67.195.228.111 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:39.241333008 CEST | 1.1.1.1 | 192.168.2.4 | 0x1133 | No error (0) | 67.195.204.73 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:39.241333008 CEST | 1.1.1.1 | 192.168.2.4 | 0x1133 | No error (0) | 67.195.228.94 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:39.241333008 CEST | 1.1.1.1 | 192.168.2.4 | 0x1133 | No error (0) | 98.136.96.74 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:39.241333008 CEST | 1.1.1.1 | 192.168.2.4 | 0x1133 | No error (0) | 67.195.228.110 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:39.241333008 CEST | 1.1.1.1 | 192.168.2.4 | 0x1133 | No error (0) | 67.195.228.109 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:39.241333008 CEST | 1.1.1.1 | 192.168.2.4 | 0x1133 | No error (0) | 98.136.96.76 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:39.241333008 CEST | 1.1.1.1 | 192.168.2.4 | 0x1133 | No error (0) | 67.195.204.77 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:59.265661001 CEST | 1.1.1.1 | 192.168.2.4 | 0xc79f | No error (0) | MX (Mail exchange) | IN (0x0001) | false | |||
| Sep 6, 2024 16:36:59.273264885 CEST | 1.1.1.1 | 192.168.2.4 | 0xcec0 | No error (0) | 64.233.166.26 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:59.273264885 CEST | 1.1.1.1 | 192.168.2.4 | 0xcec0 | No error (0) | 64.233.166.27 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:59.273264885 CEST | 1.1.1.1 | 192.168.2.4 | 0xcec0 | No error (0) | 74.125.71.27 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:59.273264885 CEST | 1.1.1.1 | 192.168.2.4 | 0xcec0 | No error (0) | 74.125.71.26 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:36:59.273264885 CEST | 1.1.1.1 | 192.168.2.4 | 0xcec0 | No error (0) | 74.125.133.26 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:37:19.281508923 CEST | 1.1.1.1 | 192.168.2.4 | 0x6cd9 | No error (0) | MX (Mail exchange) | IN (0x0001) | false | |||
| Sep 6, 2024 16:37:19.290666103 CEST | 1.1.1.1 | 192.168.2.4 | 0xceb2 | No error (0) | 217.69.139.150 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:37:19.290666103 CEST | 1.1.1.1 | 192.168.2.4 | 0xceb2 | No error (0) | 94.100.180.31 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:38:45.017087936 CEST | 1.1.1.1 | 192.168.2.4 | 0x4eed | No error (0) | 52.101.11.0 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:38:45.017087936 CEST | 1.1.1.1 | 192.168.2.4 | 0x4eed | No error (0) | 52.101.42.0 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:38:45.017087936 CEST | 1.1.1.1 | 192.168.2.4 | 0x4eed | No error (0) | 52.101.8.49 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:38:45.017087936 CEST | 1.1.1.1 | 192.168.2.4 | 0x4eed | No error (0) | 52.101.40.26 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:39:05.015393019 CEST | 1.1.1.1 | 192.168.2.4 | 0xd105 | No error (0) | 67.195.228.109 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:39:05.015393019 CEST | 1.1.1.1 | 192.168.2.4 | 0xd105 | No error (0) | 67.195.204.73 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:39:05.015393019 CEST | 1.1.1.1 | 192.168.2.4 | 0xd105 | No error (0) | 67.195.228.110 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:39:05.015393019 CEST | 1.1.1.1 | 192.168.2.4 | 0xd105 | No error (0) | 98.136.96.75 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:39:05.015393019 CEST | 1.1.1.1 | 192.168.2.4 | 0xd105 | No error (0) | 67.195.228.111 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:39:05.015393019 CEST | 1.1.1.1 | 192.168.2.4 | 0xd105 | No error (0) | 67.195.204.77 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:39:05.015393019 CEST | 1.1.1.1 | 192.168.2.4 | 0xd105 | No error (0) | 67.195.204.79 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:39:05.015393019 CEST | 1.1.1.1 | 192.168.2.4 | 0xd105 | No error (0) | 67.195.228.94 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:39:42.895200968 CEST | 1.1.1.1 | 192.168.2.4 | 0x9691 | No error (0) | 80.66.75.11 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:39:45.048182964 CEST | 1.1.1.1 | 192.168.2.4 | 0xdcc7 | No error (0) | 217.69.139.150 | A (IP address) | IN (0x0001) | false | ||
| Sep 6, 2024 16:39:45.048182964 CEST | 1.1.1.1 | 192.168.2.4 | 0xdcc7 | No error (0) | 94.100.180.31 | A (IP address) | IN (0x0001) | false |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 10:35:40 |
| Start date: | 06/09/2024 |
| Path: | C:\Users\user\Desktop\RSno9EH0K9.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 218'112 bytes |
| MD5 hash: | 8E456F932787FCD0CADBB598174575B2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 1 |
| Start time: | 10:35:45 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\SysWOW64\cmd.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x240000 |
| File size: | 236'544 bytes |
| MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 10:35:45 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 10:35:46 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\SysWOW64\cmd.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x240000 |
| File size: | 236'544 bytes |
| MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 10:35:46 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 10:35:46 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\SysWOW64\sc.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1000000 |
| File size: | 61'440 bytes |
| MD5 hash: | D9D7684B8431A0D10D0E76FE9F5FFEC8 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 10:35:46 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 7 |
| Start time: | 10:35:47 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\SysWOW64\sc.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1000000 |
| File size: | 61'440 bytes |
| MD5 hash: | D9D7684B8431A0D10D0E76FE9F5FFEC8 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 8 |
| Start time: | 10:35:47 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 9 |
| Start time: | 10:35:47 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\SysWOW64\sc.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1000000 |
| File size: | 61'440 bytes |
| MD5 hash: | D9D7684B8431A0D10D0E76FE9F5FFEC8 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 10 |
| Start time: | 10:35:47 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 11 |
| Start time: | 10:35:47 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\SysWOW64\gxtfamnt\nutgoowa.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 12'841'984 bytes |
| MD5 hash: | 834E2E11D20A334B04B409E9ECD91E76 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Has exited: | true |
| Target ID: | 12 |
| Start time: | 10:35:48 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\SysWOW64\netsh.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1560000 |
| File size: | 82'432 bytes |
| MD5 hash: | 4E89A1A088BE715D6C946E55AB07C7DF |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 13 |
| Start time: | 10:35:48 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 17 |
| Start time: | 10:36:07 |
| Start date: | 06/09/2024 |
| Path: | C:\Windows\SysWOW64\svchost.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x650000 |
| File size: | 46'504 bytes |
| MD5 hash: | 1ED18311E3DA35942DB37D15FA40CC5B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Has exited: | false |
Execution Graph
| Execution Coverage: | 4.1% |
| Dynamic/Decrypted Code Coverage: | 2% |
| Signature Coverage: | 26.3% |
| Total number of Nodes: | 1598 |
| Total number of Limit Nodes: | 21 |
Graph
Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0041A3E0 Relevance: 56.3, APIs: 30, Strings: 2, Instructions: 293timelibraryfileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0055C02E Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0041A6F6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0041A110 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46librarymemoryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35sleepfileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02070E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0055BCED Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004088B0 Relevance: .1, Instructions: 108COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0055B90B Relevance: .1, Instructions: 61COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02070D90 Relevance: .0, Instructions: 43COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02079EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02077CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02077A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 020714E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02077666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02073059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02072F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02076F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 020792CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 020799E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02076CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02076E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207E2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207E795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02077665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02079966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 020728EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 020769C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 020741F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0041A370 Relevance: 6.0, APIs: 4, Instructions: 32memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207E3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02078330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207E631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0207AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02079452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02073189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Execution Graph
| Execution Coverage: | 3.3% |
| Dynamic/Decrypted Code Coverage: | 2.1% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 1614 |
| Total number of Limit Nodes: | 16 |
Graph
Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0041A3E0 Relevance: 56.3, APIs: 30, Strings: 2, Instructions: 293timelibraryfileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadprocessinjectionCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0041A6F6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041A110 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46librarymemoryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00500E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005344AE Relevance: 1.5, APIs: 1, Instructions: 41COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0053416D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00509EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00507CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00507A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005014E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00507666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00503059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00502F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005099E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00506CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00506F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00506E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050E2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005093AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005028EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005069C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005041F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0041A370 Relevance: 6.0, APIs: 4, Instructions: 32memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050E3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00508330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00509452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00409961 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00503189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Execution Graph
| Execution Coverage: | 15.3% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 0.7% |
| Total number of Nodes: | 1808 |
| Total number of Limit Nodes: | 18 |
Graph
Function 0050C913 Relevance: 115.1, APIs: 45, Strings: 20, Instructions: 1397filestringprocessCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00509A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106memorylibraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00507A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00507809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00508328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00501D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00502D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85memorylibrarystringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00501AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00502684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050EC2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005030B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050EBED Relevance: 3.0, APIs: 2, Instructions: 27memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00501978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00501000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00501280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00502DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00509326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00506A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00506CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00506BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00504280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00502923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00509145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00502419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00506EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00503F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00503F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00504E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00504BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 005026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00509961 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0050EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00502F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|