Edit tour

Windows Analysis Report
Insanity Loader.exe

Overview

General Information

Sample name:	Insanity Loader.exe
Analysis ID:	1507525
MD5:	3fd87bf20a6572f497fd8707d6a48dc8
SHA1:	b87ea66e5642608ba518b1eba1f8d7965747bb1b
SHA256:	91e1004b69d539f58774601b050151fb6fb706e03b5f65aa6288a586048e9563
Tags:	exe
Infos:

Detection

RedLine

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected RedLine Stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Enables security privileges

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Insanity Loader.exe (PID: 5664 cmdline: "C:\Users\user\Desktop\Insanity Loader.exe" MD5: 3FD87BF20A6572F497FD8707D6A48DC8)

conhost.exe (PID: 4180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Insanity Loader.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 45 88 44 24 2B 88 44 24 2F B0 CE 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Insanity Loader.exe PID: 5664	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Insanity Loader.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 45 88 44 24 2B 88 44 24 2F B0 CE 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.Insanity Loader.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 45 88 44 24 2B 88 44 24 2F B0 CE 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: Insanity Loader.exe

Joe Sandbox ML: detected

Source: Insanity Loader.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:

Binary string: _.pdb source: Insanity Loader.exe, 00000000.00000002.2041056918.00000000021F7000.00000004.00000020.00020000.00000000.sdmp, Insanity Loader.exe, 00000000.00000003.2028306043.000000000067B000.00000004.00000020.00020000.00000000.sdmp, Insanity Loader.exe, 00000000.00000002.2044454481.0000000003521000.00000004.00000800.00020000.00000000.sdmp, Insanity Loader.exe, 00000000.00000002.2044602082.0000000004B10000.00000004.08000000.00040000.00000000.sdmp

Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`,]q equals www.youtube.com (Youtube)
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,]q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)

Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: Insanity Loader.exe, 00000000.00000002.2041615026.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/

Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002795000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_f261fa75-7

System Summary

Malicious sample detected (through community Yara rule)

Source: Insanity Loader.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.Insanity Loader.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.Insanity Loader.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, HWiM5nizdBqTYpoFw7P.cs	Large array initialization: HWiM5nizdBqTYpoFw7P: array initializer size 6160
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, HWiM5nizdBqTYpoFw7P.cs	Large array initialization: HWiM5nizdBqTYpoFw7P: array initializer size 6160
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, HWiM5nizdBqTYpoFw7P.cs	Large array initialization: HWiM5nizdBqTYpoFw7P: array initializer size 6160
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, HWiM5nizdBqTYpoFw7P.cs	Large array initialization: HWiM5nizdBqTYpoFw7P: array initializer size 6160
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, HWiM5nizdBqTYpoFw7P.cs	Large array initialization: HWiM5nizdBqTYpoFw7P: array initializer size 6160

Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_00408C60	0_2_00408C60
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_0040DC11	0_2_0040DC11
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_00407C3F	0_2_00407C3F
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_00418CCC	0_2_00418CCC
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_00406CA0	0_2_00406CA0
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_004028B0	0_2_004028B0
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_0041A4BE	0_2_0041A4BE
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_00418244	0_2_00418244
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_00401650	0_2_00401650
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_00402F20	0_2_00402F20
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_004193C4	0_2_004193C4
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_00418788	0_2_00418788
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_00402F89	0_2_00402F89
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_00402B90	0_2_00402B90
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_004073A0	0_2_004073A0
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_0215E17C	0_2_0215E17C
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_02152ECC	0_2_02152ECC
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_053A1638	0_2_053A1638
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_053A01D8	0_2_053A01D8
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_053A01C8	0_2_053A01C8
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_054ED3B0	0_2_054ED3B0
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_054ECE88	0_2_054ECE88
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_056B04D0	0_2_056B04D0
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_056B6C18	0_2_056B6C18

Source: C:\Users\user\Desktop\Insanity Loader.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\Desktop\Insanity Loader.exe

Code function: String function: 0040E1D8 appears 44 times

Source: Insanity Loader.exe, 00000000.00000003.2028040085.00000000006FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2041056918.00000000021F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2041056918.00000000021F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000003.2028108861.0000000000711000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000003.2028306043.000000000067B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000003.2028306043.000000000067B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2044966965.0000000005230000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2044454481.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2044454481.0000000003521000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2044602082.0000000004B10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe
Source: Insanity Loader.exe, 00000000.00000002.2044602082.0000000004B10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs Insanity Loader.exe
Source: Insanity Loader.exe	Binary or memory string: OriginalFilenameParsimony.exe" vs Insanity Loader.exe

Source: Insanity Loader.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Insanity Loader.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.Insanity Loader.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.Insanity Loader.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, HWiM5nizdBqTYpoFw7P.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, vnUNrf9zTHJhL6tQfxd.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, HWiM5nizdBqTYpoFw7P.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, vnUNrf9zTHJhL6tQfxd.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, HWiM5nizdBqTYpoFw7P.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, vnUNrf9zTHJhL6tQfxd.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, HWiM5nizdBqTYpoFw7P.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, vnUNrf9zTHJhL6tQfxd.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, HWiM5nizdBqTYpoFw7P.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, vnUNrf9zTHJhL6tQfxd.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal72.troj.evad.winEXE@2/1@0/0

Source: C:\Users\user\Desktop\Insanity Loader.exe

Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

0_2_004019F0

Source: C:\Users\user\Desktop\Insanity Loader.exe

0_2_004019F0

Source: C:\Users\user\Desktop\Insanity Loader.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Insanity Loader.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Insanity Loader.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4180:120:WilError_03

Source: C:\Users\user\Desktop\Insanity Loader.exe

Command line argument: 08A

0_2_00413780

Source: Insanity Loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Insanity Loader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Insanity Loader.exe "C:\Users\user\Desktop\Insanity Loader.exe"
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\Insanity Loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Insanity Loader.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Users\user\Desktop\Insanity Loader.exe

0_2_004019F0

Source: Insanity Loader.exe

Static PE information: real checksum: 0x23bfb should be: 0x883eb

Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_0040E21D push ecx; ret	0_2_0040E230
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_053A8438 push esp; retf	0_2_053A8481
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_053A9A60 push esp; iretd	0_2_053A9A61
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_056B900D push FFFFFF8Bh; iretd	0_2_056B900F

Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, JrDgcb8ExbnxoKvHj0h.cs	High entropy of concatenated method names: 'ShowMessage', 'VxW8CTIwiU', 'IKm8os5L55', 'gom8AC5UqJ', 'B0b8F7YMg0', 'E0c8g7rGpw', 'reY848S8mQ', 'aKZ8z7WlxN', 'nDRQayamBL', 'U5OQ6dLhrU'
Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, eYHragi8ZCpLS1lWPwX.cs	High entropy of concatenated method names: 'lb8iuDNCWP', 'A5UiZDAsol', 'XSai99a8ti', 'S1Eily3Nq0', 'OMTiJWE6ZX', 'AfyitOTe6J', 'LqEiDT7lu7', 'VXbiPDVIHO', 'wjwibsCoYQ', 'pKaidcbP2q'
Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, HMcqtE6J6r1oToPnxPf.cs	High entropy of concatenated method names: 'rpg63nTtcd', 'Fme6OAaSE1', 'MS16rZKoi4', 'wAO6N8pqBw', 'n6p6DgAamV', 'R3o6PgF73A', 'ekH6bn75Ls', 'wrq6dI3ts6', 'jXM60OtGM7', 'KO76wXfsvZ'
Source: 0.2.Insanity Loader.exe.4b10ee8.6.raw.unpack, qqaOQ7MORaiyuX290kx.cs	High entropy of concatenated method names: 'NOCbz6OMLf', 'TALdQQC9dP', 'qcuMrAL091', 'sGCMNdH9uR', 'DD3MIrZ56s', 'xEvMeNt3nr', 'tgNMcYqoLe', 'hHUbghaJSm', 'bmHdatxIPx', 'AgoduRIEmN'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, JrDgcb8ExbnxoKvHj0h.cs	High entropy of concatenated method names: 'ShowMessage', 'VxW8CTIwiU', 'IKm8os5L55', 'gom8AC5UqJ', 'B0b8F7YMg0', 'E0c8g7rGpw', 'reY848S8mQ', 'aKZ8z7WlxN', 'nDRQayamBL', 'U5OQ6dLhrU'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, eYHragi8ZCpLS1lWPwX.cs	High entropy of concatenated method names: 'lb8iuDNCWP', 'A5UiZDAsol', 'XSai99a8ti', 'S1Eily3Nq0', 'OMTiJWE6ZX', 'AfyitOTe6J', 'LqEiDT7lu7', 'VXbiPDVIHO', 'wjwibsCoYQ', 'pKaidcbP2q'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, HMcqtE6J6r1oToPnxPf.cs	High entropy of concatenated method names: 'rpg63nTtcd', 'Fme6OAaSE1', 'MS16rZKoi4', 'wAO6N8pqBw', 'n6p6DgAamV', 'R3o6PgF73A', 'ekH6bn75Ls', 'wrq6dI3ts6', 'jXM60OtGM7', 'KO76wXfsvZ'
Source: 0.2.Insanity Loader.exe.2238ab6.2.raw.unpack, qqaOQ7MORaiyuX290kx.cs	High entropy of concatenated method names: 'NOCbz6OMLf', 'TALdQQC9dP', 'qcuMrAL091', 'sGCMNdH9uR', 'DD3MIrZ56s', 'xEvMeNt3nr', 'tgNMcYqoLe', 'hHUbghaJSm', 'bmHdatxIPx', 'AgoduRIEmN'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, JrDgcb8ExbnxoKvHj0h.cs	High entropy of concatenated method names: 'ShowMessage', 'VxW8CTIwiU', 'IKm8os5L55', 'gom8AC5UqJ', 'B0b8F7YMg0', 'E0c8g7rGpw', 'reY848S8mQ', 'aKZ8z7WlxN', 'nDRQayamBL', 'U5OQ6dLhrU'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, eYHragi8ZCpLS1lWPwX.cs	High entropy of concatenated method names: 'lb8iuDNCWP', 'A5UiZDAsol', 'XSai99a8ti', 'S1Eily3Nq0', 'OMTiJWE6ZX', 'AfyitOTe6J', 'LqEiDT7lu7', 'VXbiPDVIHO', 'wjwibsCoYQ', 'pKaidcbP2q'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, HMcqtE6J6r1oToPnxPf.cs	High entropy of concatenated method names: 'rpg63nTtcd', 'Fme6OAaSE1', 'MS16rZKoi4', 'wAO6N8pqBw', 'n6p6DgAamV', 'R3o6PgF73A', 'ekH6bn75Ls', 'wrq6dI3ts6', 'jXM60OtGM7', 'KO76wXfsvZ'
Source: 0.2.Insanity Loader.exe.3576790.5.raw.unpack, qqaOQ7MORaiyuX290kx.cs	High entropy of concatenated method names: 'NOCbz6OMLf', 'TALdQQC9dP', 'qcuMrAL091', 'sGCMNdH9uR', 'DD3MIrZ56s', 'xEvMeNt3nr', 'tgNMcYqoLe', 'hHUbghaJSm', 'bmHdatxIPx', 'AgoduRIEmN'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, JrDgcb8ExbnxoKvHj0h.cs	High entropy of concatenated method names: 'ShowMessage', 'VxW8CTIwiU', 'IKm8os5L55', 'gom8AC5UqJ', 'B0b8F7YMg0', 'E0c8g7rGpw', 'reY848S8mQ', 'aKZ8z7WlxN', 'nDRQayamBL', 'U5OQ6dLhrU'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, eYHragi8ZCpLS1lWPwX.cs	High entropy of concatenated method names: 'lb8iuDNCWP', 'A5UiZDAsol', 'XSai99a8ti', 'S1Eily3Nq0', 'OMTiJWE6ZX', 'AfyitOTe6J', 'LqEiDT7lu7', 'VXbiPDVIHO', 'wjwibsCoYQ', 'pKaidcbP2q'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, HMcqtE6J6r1oToPnxPf.cs	High entropy of concatenated method names: 'rpg63nTtcd', 'Fme6OAaSE1', 'MS16rZKoi4', 'wAO6N8pqBw', 'n6p6DgAamV', 'R3o6PgF73A', 'ekH6bn75Ls', 'wrq6dI3ts6', 'jXM60OtGM7', 'KO76wXfsvZ'
Source: 0.2.Insanity Loader.exe.3526458.3.raw.unpack, qqaOQ7MORaiyuX290kx.cs	High entropy of concatenated method names: 'NOCbz6OMLf', 'TALdQQC9dP', 'qcuMrAL091', 'sGCMNdH9uR', 'DD3MIrZ56s', 'xEvMeNt3nr', 'tgNMcYqoLe', 'hHUbghaJSm', 'bmHdatxIPx', 'AgoduRIEmN'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, JrDgcb8ExbnxoKvHj0h.cs	High entropy of concatenated method names: 'ShowMessage', 'VxW8CTIwiU', 'IKm8os5L55', 'gom8AC5UqJ', 'B0b8F7YMg0', 'E0c8g7rGpw', 'reY848S8mQ', 'aKZ8z7WlxN', 'nDRQayamBL', 'U5OQ6dLhrU'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, eYHragi8ZCpLS1lWPwX.cs	High entropy of concatenated method names: 'lb8iuDNCWP', 'A5UiZDAsol', 'XSai99a8ti', 'S1Eily3Nq0', 'OMTiJWE6ZX', 'AfyitOTe6J', 'LqEiDT7lu7', 'VXbiPDVIHO', 'wjwibsCoYQ', 'pKaidcbP2q'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, HMcqtE6J6r1oToPnxPf.cs	High entropy of concatenated method names: 'rpg63nTtcd', 'Fme6OAaSE1', 'MS16rZKoi4', 'wAO6N8pqBw', 'n6p6DgAamV', 'R3o6PgF73A', 'ekH6bn75Ls', 'wrq6dI3ts6', 'jXM60OtGM7', 'KO76wXfsvZ'
Source: 0.2.Insanity Loader.exe.5230000.8.raw.unpack, qqaOQ7MORaiyuX290kx.cs	High entropy of concatenated method names: 'NOCbz6OMLf', 'TALdQQC9dP', 'qcuMrAL091', 'sGCMNdH9uR', 'DD3MIrZ56s', 'xEvMeNt3nr', 'tgNMcYqoLe', 'hHUbghaJSm', 'bmHdatxIPx', 'AgoduRIEmN'

Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\]Q
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE`,]Q
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE

Source: C:\Users\user\Desktop\Insanity Loader.exe	Memory allocated: 2150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Memory allocated: 2520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Memory allocated: 4520000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Insanity Loader.exe

0_2_004019F0

Source: C:\Users\user\Desktop\Insanity Loader.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Insanity Loader.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-54594

Source: C:\Users\user\Desktop\Insanity Loader.exe TID: 3572

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Insanity Loader.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe`,]q
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\]q

Source: C:\Users\user\Desktop\Insanity Loader.exe

API call chain: ExitProcess graph end node

graph_0-54829

Source: C:\Users\user\Desktop\Insanity Loader.exe

Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0040CE09

Source: C:\Users\user\Desktop\Insanity Loader.exe

0_2_004019F0

Source: C:\Users\user\Desktop\Insanity Loader.exe

0_2_004019F0

Source: C:\Users\user\Desktop\Insanity Loader.exe

Code function: 0_2_0040ADB0 GetProcessHeap,HeapFree,

0_2_0040ADB0

Source: C:\Users\user\Desktop\Insanity Loader.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040CE09
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040E61C
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00416F6A
Source: C:\Users\user\Desktop\Insanity Loader.exe	Code function: 0_2_004123F1 SetUnhandledExceptionFilter,	0_2_004123F1

Source: C:\Users\user\Desktop\Insanity Loader.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002795000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: Insanity Loader.exe, 00000000.00000002.2041615026.0000000002795000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\Insanity Loader.exe

Code function: GetLocaleInfoA,

0_2_00417A20

Source: C:\Users\user\Desktop\Insanity Loader.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Insanity Loader.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Insanity Loader.exe

Code function: 0_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00412A15

Source: C:\Users\user\Desktop\Insanity Loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match

File source: Process Memory Space: Insanity Loader.exe PID: 5664, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match

File source: Process Memory Space: Insanity Loader.exe PID: 5664, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Insanity Loader.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://discord.com/api/v9/users/	0%	Avira URL Cloud	safe
https://api.ip.s	0%	Avira URL Cloud	safe
https://api.ip.sb/ip	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ip.sb/ip	Insanity Loader.exe, 00000000.00000002.2041615026.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.s	Insanity Loader.exe, 00000000.00000002.2041615026.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.com/api/v9/users/	Insanity Loader.exe, 00000000.00000002.2041615026.0000000002646000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1507525
Start date and time:	2024-09-08 15:48:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Insanity Loader.exe
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 44 Number of non-executed functions: 33
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Insanity Loader.exe

Process:	C:\Users\user\Desktop\Insanity Loader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.729921049550876
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Insanity Loader.exe
File size:	512'000 bytes
MD5:	3fd87bf20a6572f497fd8707d6a48dc8
SHA1:	b87ea66e5642608ba518b1eba1f8d7965747bb1b
SHA256:	91e1004b69d539f58774601b050151fb6fb706e03b5f65aa6288a586048e9563
SHA512:	009dc5784ddd5707489b6ddd177598d8db6dd8b26d497e4c9bc64254e9e7a5d406fde3d59e5bd140b683cc3526e02e39608f24b272aba0fbcca4bcb6241fcacc
SSDEEP:	12288:ph1Lk70TnvjcFqTKfKvMWm3bgZBItgyHn2F05dMF:1k70TrcFqGhWmruWuyH8OMF
TLSH:	40B402207480C5B6C8B2513084D6CB366F3976621B76D6D77ADD277A2F213D3E2392C9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~..................6.....PE..L...t..P..........#........

File Icon


Icon Hash:	39399a4c45611d03

Static PE Info

General

Entrypoint:	0x40cd2f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5000A574 [Fri Jul 13 22:47:16 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	bf5a4aa99e5b160f8521cadd6bfe73b8

Entrypoint Preview

Instruction
call 00007F5C208DDA36h
jmp 00007F5C208D7BF9h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0041F058h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F5C208D7D5Eh
test byte ptr [eax], 00000008h
je 00007F5C208D7D59h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0041B000h]
leave
retn 0008h
ret
mov eax, 00413563h
mov dword ptr [004228E4h], eax
mov dword ptr [004228E8h], 00412C4Ah
mov dword ptr [004228ECh], 00412BFEh
mov dword ptr [004228F0h], 00412C37h
mov dword ptr [004228F4h], 00412BA0h
mov dword ptr [004228F8h], eax
mov dword ptr [004228FCh], 004134DBh
mov dword ptr [00422900h], 00412BBCh
mov dword ptr [00422904h], 00412B1Eh
mov dword ptr [00422908h], 00412AABh
ret
mov edi, edi
push ebp
mov ebp, esp
call 00007F5C208D7CEBh
call 00007F5C208DE570h
cmp dword ptr [ebp+00h], 00000000h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x215b4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x5afa4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b1c0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20da0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19718	0x19800	dfd9b4979fee42231b971517a1ca7fcb	False	0.5789388020833334	data	6.748508550860781	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x6db4	0x6e00	5826801f33fc1b607aa8e942aa92e9fa	False	0.5467329545454546	data	6.442956247632331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22000	0x30c0	0x1600	2fe51a72ede820cd7cf55a77ba59b1f4	False	0.3126775568181818	data	3.2625868398009703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x26000	0x5afa4	0x5b000	a4a8b35ef6132b317ac458da6f7dd2df	False	0.9647713126717034	data	7.920274953517197	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x263c4	0x6b1d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.993508624776631
RT_ICON	0x2cee4	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	0.4432926829268293
RT_ICON	0x2d54c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.553763440860215
RT_ICON	0x2d834	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.625
RT_ICON	0x2d95c	0x8efc	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9948912687138017
RT_ICON	0x36858	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.5575692963752665
RT_ICON	0x37700	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.7107400722021661
RT_ICON	0x37fa8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.5151734104046243
RT_ICON	0x38510	0xced3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9982246397340737
RT_ICON	0x453e4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.48018672199170126
RT_ICON	0x4798c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.5318949343339587
RT_ICON	0x48a34	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.6888297872340425
RT_RCDATA	0x48e9c	0x37b3a	data	1.0003331083391043
RT_RCDATA	0x809d8	0x20	Non-ISO extended-ASCII text, with no line terminators, with escape sequences	1.34375
RT_GROUP_ICON	0x809f8	0xae	data	0.632183908045977
RT_VERSION	0x80aa8	0x30e	data	0.4514066496163683
RT_MANIFEST	0x80db8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
KERNEL32.dll	RaiseException, GetLastError, MultiByteToWideChar, lstrlenA, InterlockedDecrement, GetProcAddress, LoadLibraryA, FreeResource, SizeofResource, LockResource, LoadResource, FindResourceA, GetModuleHandleA, Module32Next, CloseHandle, Module32First, CreateToolhelp32Snapshot, GetCurrentProcessId, SetEndOfFile, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetLocaleInfoA, HeapFree, GetProcessHeap, HeapAlloc, GetCommandLineA, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, ReadFile, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, FlushFileBuffers, SetFilePointer, SetHandleCount, GetFileType, GetStartupInfoA, RtlUnwind, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CompareStringA, CompareStringW, SetEnvironmentVariableA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, CreateFileA
ole32.dll	OleInitialize
OLEAUT32.dll	SafeArrayCreate, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayDestroy, SafeArrayCreateVector, VariantClear, VariantInit, SysFreeString, SysAllocString

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 8, 2024 15:49:50.227878094 CEST	53	57596	162.159.36.2	192.168.2.5
Sep 8, 2024 15:49:50.731770039 CEST	53	64497	1.1.1.1	192.168.2.5

Target ID:	0
Start time:	09:49:03
Start date:	08/09/2024
Path:	C:\Users\user\Desktop\Insanity Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Insanity Loader.exe"
Imagebase:	0x400000
File size:	512'000 bytes
MD5 hash:	3FD87BF20A6572F497FD8707D6A48DC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:49:03
Start date:	08/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	75.8%
Signature Coverage:	4.9%
Total number of Nodes:	912
Total number of Limit Nodes:	71

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

5, xrefs: 00402109
., xrefs: 00401B0A
0, xrefs: 00401BBD
h, xrefs: 00401A6F
*, xrefs: 00401A1F
x, xrefs: 00401E69
[, xrefs: 00402047
", xrefs: 00401B0F
!, xrefs: 004020CF
o, xrefs: 00402159
V, xrefs: 00402038
___, xrefs: 0040227D
v, xrefs: 00401E4B
4, xrefs: 00402136
{, xrefs: 0040205B
V, xrefs: 00401E19
W, xrefs: 00401B14
v, xrefs: 0040206A
U, xrefs: 004020F5
x, xrefs: 00402088
8, xrefs: 00401BA9
!, xrefs: 00401B1E
[, xrefs: 00401B37
), xrefs: 0040202E
W, xrefs: 004020E6
o, xrefs: 00402097
W, xrefs: 00402033
', xrefs: 00401AF6
W, xrefs: 00401B23
*, xrefs: 004020E1
x, xrefs: 0040214A
6, xrefs: 004020C5
E, xrefs: 00401E0F
:, xrefs: 00401B28
!, xrefs: 0040201A
', xrefs: 00402006
4, xrefs: 00401B64
{, xrefs: 0040211D
{, xrefs: 00401E3C
D, xrefs: 00401DFB
{, xrefs: 00401B4B
o, xrefs: 00401B8D
%, xrefs: 004020FA
x, xrefs: 00401B78
_._, xrefs: 00402257
4, xrefs: 00402074
., xrefs: 0040201F
v, xrefs: 0040212C
v, xrefs: 00401B5A

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: Resource$Module32$CloseFindHandleNextSizeof$ChangeCreateCurrentFirstInitializeLoadLockModuleNotificationProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 2366190142-2962942730
Opcode ID: 224088bd6fdf40f00aacdd5f7db7c03047c3cc993abb63ba2c7175de51848a6e
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 224088bd6fdf40f00aacdd5f7db7c03047c3cc993abb63ba2c7175de51848a6e
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 053A1638 Relevance: 1.5, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

, xrefs: 053A1791

Memory Dump Source

Source File: 00000000.00000002.2045179714.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53a0000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID: 0-76226702
Opcode ID: daaaf56acd7ed661bd3f91006973b022672c6f6ccaa5a283335ea9aaec4ee207
Instruction ID: a7a23d52d81d8d1c47236f0fc6f9deb2baa0f8ffa58888a3a02d5eac5d39089c
Opcode Fuzzy Hash: daaaf56acd7ed661bd3f91006973b022672c6f6ccaa5a283335ea9aaec4ee207
Instruction Fuzzy Hash: 9F915B75B006058FCB18EF79D49096ABBF6FF88310B008969D80ACB755EF74E945CB90

Function 056B04D0 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045623724.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56b0000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93798fb3e659a4ed1302169d433e94e2f8f78487d91b974970ffb1780227519c
Instruction ID: 9c24d773fc7d1abfd86d8c2fd55a06ed6ae276753317d152a025047aaf40a43a
Opcode Fuzzy Hash: 93798fb3e659a4ed1302169d433e94e2f8f78487d91b974970ffb1780227519c
Instruction Fuzzy Hash: 0EA1E074D05228CFEB14DFA9C5887EEBBF2BF49311F1091A9D409A7291DB749A86CF10

Function 053ABD7B Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 053ABE10
Haq, xrefs: 053ABE9A
Haq, xrefs: 053ABE55
Haq, xrefs: 053AC194
Haq, xrefs: 053AC161

Memory Dump Source

Source File: 00000000.00000002.2045179714.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53a0000_Insanity Loader.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$Haq$Haq
API String ID: 0-1792267638
Opcode ID: a2ba7ec311d39cd7241308e62dc78d756c6c642a4b82ec705d009ba60db19cb6
Instruction ID: 3d24ccbd8d4c4aa83c98364422f4651595289a1f5ced66d9bb9a5316c5f18393
Opcode Fuzzy Hash: a2ba7ec311d39cd7241308e62dc78d756c6c642a4b82ec705d009ba60db19cb6
Instruction Fuzzy Hash: 2CC15B35B002188FCB14EBA8C5949AEBBF6FF89310F2444A9D506AB3A4DF75DD41CB61

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 0215D5F0 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0215D67E
GetCurrentThread.KERNEL32 ref: 0215D6BB
GetCurrentProcess.KERNEL32 ref: 0215D6F8
GetCurrentThreadId.KERNEL32 ref: 0215D751

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1216ec0648a6b4e153864ec72c232b9a1060c63fd9a77fab6d26a3b7cec74299
Instruction ID: bd0016ace00877299c879bbec4c04c79fbcef382fe72ce9dd94d1f2783f9a36a
Opcode Fuzzy Hash: 1216ec0648a6b4e153864ec72c232b9a1060c63fd9a77fab6d26a3b7cec74299
Instruction Fuzzy Hash: 205167B0900349CFDB14DFA9D648BAEBFF5EF89304F208499E419A7360D7789984CB65

Function 0215D600 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0215D67E
GetCurrentThread.KERNEL32 ref: 0215D6BB
GetCurrentProcess.KERNEL32 ref: 0215D6F8
GetCurrentThreadId.KERNEL32 ref: 0215D751

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eaa71c1e98e3b303cbe72f38b0f208f227fdd3f7a289c17c0b2f516d717208f7
Instruction ID: 82d59a92e9e1e483e2fe19f0d0b0b97f560f6d998c3fea9f54e9dc4ea1f16527
Opcode Fuzzy Hash: eaa71c1e98e3b303cbe72f38b0f208f227fdd3f7a289c17c0b2f516d717208f7
Instruction Fuzzy Hash: C85167B0900309CFDB14DFA9D649BAEBFF5EF89304F208499E419A7360D7749984CB65

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 0215B358 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0215B5BE

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a221fd2b72d858ea10b18c8a396dcede0b623242ab00e86772dbb129e7b2eb25
Instruction ID: a93b9164bdcaf19f5ead303c093e13cfcf436dcb440fa13c41d3661d01a1afd4
Opcode Fuzzy Hash: a221fd2b72d858ea10b18c8a396dcede0b623242ab00e86772dbb129e7b2eb25
Instruction Fuzzy Hash: 13813470A44B14CFD764DF29D1407AABBF2FF88304F008A69D896D7A54DB74E94ACB90

Function 053A1E31 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 053A1FA2

Memory Dump Source

Source File: 00000000.00000002.2045179714.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53a0000_Insanity Loader.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b5fc5a6aa72c7ca5ce342360b9aba0e499d1b7069bc9e733c7fef7df59d22ba4
Instruction ID: a8f2123a0657c231b4a5a1f6f1808d807f32c99e6155cdaf763e742faf9d574a
Opcode Fuzzy Hash: b5fc5a6aa72c7ca5ce342360b9aba0e499d1b7069bc9e733c7fef7df59d22ba4
Instruction Fuzzy Hash: D65102B2C04249AFCF11CFA9C984ADEBFB2FF49310F14816AE918AB221D7759845CF50

Function 02155E75 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02155F31

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 77dc276f498b1fcee862a0dc79a8769c7d0a7ef998a7c198de5a65f296f06925
Instruction ID: 5e913b5256ae6b7a5152108bb0ff4176de65bedcd0ad0f033733cbc4b517306f
Opcode Fuzzy Hash: 77dc276f498b1fcee862a0dc79a8769c7d0a7ef998a7c198de5a65f296f06925
Instruction Fuzzy Hash: 12410FB1C00619DEDB24DFA9C9447DDBBF6FF48304F2080AAD918AB250D779694ACF90

Function 053A1E85 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 053A1FA2

Memory Dump Source

Source File: 00000000.00000002.2045179714.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53a0000_Insanity Loader.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 619c0209c8dcc1743f9863602a9f0285cb9dc18f3d30e85715b8e0a1e44e3a62
Instruction ID: 054a6a0da42ce465fba213b6345eaae120ea39315999ab239cca70ae0937f73c
Opcode Fuzzy Hash: 619c0209c8dcc1743f9863602a9f0285cb9dc18f3d30e85715b8e0a1e44e3a62
Instruction Fuzzy Hash: DB51C2B1D003499FDB14CF99C984ADEBFB6FF48310F24822AE819AB250D775A945CF90

Function 053A1E90 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 053A1FA2

Memory Dump Source

Source File: 00000000.00000002.2045179714.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53a0000_Insanity Loader.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f5130d66d64c4ab1468d269cc949327d2e9a22ce39b4264ee61409d7ed6b3370
Instruction ID: 423362668df56be8a0312d7b4c181d3c35e570034b14dde791e494aabdb5db81
Opcode Fuzzy Hash: f5130d66d64c4ab1468d269cc949327d2e9a22ce39b4264ee61409d7ed6b3370
Instruction Fuzzy Hash: 0141B2B1D003499FDB14CF99C984ADEBFB6FF48310F24822AE819AB250D775A945CF90

Function 02154998 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02155F31

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 85f6b61045f55e07aef41927271fcb48c7af6c70d18ca342e9b0ffc039dad880
Instruction ID: 75477c130b928ead0b5ccc110edb067b264e866678ddbcecfffb794689108760
Opcode Fuzzy Hash: 85f6b61045f55e07aef41927271fcb48c7af6c70d18ca342e9b0ffc039dad880
Instruction Fuzzy Hash: C54102B0C00619DADB24DFA9C944B8DBBB6FF44304F6080AAD818AB254DB75694ACF90

Function 054E3204 Relevance: 1.6, APIs: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 054EDF45

Memory Dump Source

Source File: 00000000.00000002.2045327792.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Insanity Loader.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6264f8620970c136f8fd06c4cef55a2c50c784c6da218578c0a77e371ac87521
Instruction ID: cc8d3cee7db80886db62a75cf6d145847d6c06d0063793c36de0689a78533be0
Opcode Fuzzy Hash: 6264f8620970c136f8fd06c4cef55a2c50c784c6da218578c0a77e371ac87521
Instruction Fuzzy Hash: 742139B59042089FCB10DFA9D888BEEBFF8EF49310F14845AE519A7350C774A944CFA5

Function 053A448E Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 053A4521

Memory Dump Source

Source File: 00000000.00000002.2045179714.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53a0000_Insanity Loader.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 36be671decd3f816928745b7263c913dd6dc997eece44c5c8eea504493a85813
Instruction ID: 885e5ba0222a7add4151b7d53e148f483db7af9359a126812e93cb168e6fff6c
Opcode Fuzzy Hash: 36be671decd3f816928745b7263c913dd6dc997eece44c5c8eea504493a85813
Instruction Fuzzy Hash: 9A3118B9A002059FDB14CF99C449AAABBF6FF88314F24C459D519AB321D7B4E841CBA0

Function 0215D840 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0215D8CF

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1c5e9b22506c62570782a8333583a4e36090e1e6c105bf816679f446114fbf19
Instruction ID: d04e43771eb8c97c3a6f300a944a77d804072c86f26135316c86ba4a4a7d46f6
Opcode Fuzzy Hash: 1c5e9b22506c62570782a8333583a4e36090e1e6c105bf816679f446114fbf19
Instruction Fuzzy Hash: 4F2105B5D00208AFDB10CFAAD584ADEBBF9FB48310F10845AE914A3310D378A944CFA0

Function 054EE948 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 054EE9CC

Memory Dump Source

Source File: 00000000.00000002.2045327792.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Insanity Loader.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: ee282e3a8ff9038c4618060ea369514efe5ccfb0fda616ce8100f3a654969eb3
Instruction ID: 0167dc8fb22c686457d776932904de894f4821bbbd857b3f8b876bb30b1393cc
Opcode Fuzzy Hash: ee282e3a8ff9038c4618060ea369514efe5ccfb0fda616ce8100f3a654969eb3
Instruction Fuzzy Hash: DF2125B19012098FDB10DF9AC884ADEFBF8FF48210F14846AE959A3350D378A904CB64

Function 0215D848 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0215D8CF

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4834353795b23ae79a44dbb07fa53f7135f3f0a994ea26bc1fc4b18796bd02a6
Instruction ID: ebf7e7ec04f573057af722f3dca9e839d858626346297fd6714ec538f054afb3
Opcode Fuzzy Hash: 4834353795b23ae79a44dbb07fa53f7135f3f0a994ea26bc1fc4b18796bd02a6
Instruction Fuzzy Hash: 8221E4B5900208DFDB10DF9AD584ADEBFF9FB48310F14845AE918A3350D378A944CFA0

Function 054EE950 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 054EE9CC

Memory Dump Source

Source File: 00000000.00000002.2045327792.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Insanity Loader.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 6986dfdfcaf5771abfc8f4994958f8f21f53bd81fd129c2d4827e03e6335543a
Instruction ID: 561ebbf5608dfe22dfca24ba80229c19aad1fceba05fa6ca6aaf28b61edbc9ad
Opcode Fuzzy Hash: 6986dfdfcaf5771abfc8f4994958f8f21f53bd81fd129c2d4827e03e6335543a
Instruction Fuzzy Hash: EE2115B19017098FDB10DF9AC884ADEFBF8FF48310F14846AE959A3340D378A944CB65

Function 053A2098 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 053A2135

Memory Dump Source

Source File: 00000000.00000002.2045179714.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53a0000_Insanity Loader.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 12d80b88882ecbb51a8f66267f0d372775ca31be60c3eb5e54c078bb7490d7b6
Instruction ID: 51872b097505715d608e24586375120de26884ffc1b6d5d0c8d0aeaf75ec8b93
Opcode Fuzzy Hash: 12d80b88882ecbb51a8f66267f0d372775ca31be60c3eb5e54c078bb7490d7b6
Instruction Fuzzy Hash: 7E216ABA800209CFDB10DF99D949BDEBFF4EB48314F14845AE919A7260C379A944CFA1

Function 0215AD60 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0215B639,00000800,00000000,00000000), ref: 0215B84A

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6e2f01a6690d884cdb28ed43a86d868489ef15eb6c127c03734ec51282753d60
Instruction ID: 62d94182de837df3954fab45fd8f93fc415756f10a80fe90419f2d38f0ae9ed8
Opcode Fuzzy Hash: 6e2f01a6690d884cdb28ed43a86d868489ef15eb6c127c03734ec51282753d60
Instruction Fuzzy Hash: 831114B6D04308CFCB10DF9AC544BAEFBF4EB48314F10846AD929A7210C379AA45CFA4

Function 054EB060 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 054EB0D2

Memory Dump Source

Source File: 00000000.00000002.2045327792.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Insanity Loader.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: ff20473821ca27cc9cca0b0900291e44e6eba057fb5a9c37aadd6dd31889d1c2
Instruction ID: 195b55ed700527e6363ad8256c9d2d443fa0b96440f73c65c453807b4349a442
Opcode Fuzzy Hash: ff20473821ca27cc9cca0b0900291e44e6eba057fb5a9c37aadd6dd31889d1c2
Instruction Fuzzy Hash: CB1124B68006498BCB14CF9AC544BEEBBF4EB48320F14842AD868A3350D338A549CFA1

Function 054EB068 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 054EB0D2

Memory Dump Source

Source File: 00000000.00000002.2045327792.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Insanity Loader.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 77b4d94f74d774433632444787edb00a7d0305fa5ed2f66fea2d856aa3cf1c7b
Instruction ID: afbb93618b900902f0fd1c3db364162840cb87909c2f3d71a2fa5a707d1993ec
Opcode Fuzzy Hash: 77b4d94f74d774433632444787edb00a7d0305fa5ed2f66fea2d856aa3cf1c7b
Instruction Fuzzy Hash: 5A1114B28002498FDB10DF9AC444BDEFBF5EB48320F10842AD969A3350D378A549CFA1

Function 0215B7D8 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0215B639,00000800,00000000,00000000), ref: 0215B84A

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a2354d5629c440867198fff554246ef35788f547999af0d31f65d8931ca8a8c1
Instruction ID: cb732786f562f8f9fc8dc0482bbe6b15842226be149808888e5a206ee3b0705b
Opcode Fuzzy Hash: a2354d5629c440867198fff554246ef35788f547999af0d31f65d8931ca8a8c1
Instruction Fuzzy Hash: B711E2B6D00309CFDB10DF9AD544AEEFBF5AB48314F14846AD929B7250C378AA45CFA4

Function 056B74A8 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 056B750F

Memory Dump Source

Source File: 00000000.00000002.2045623724.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56b0000_Insanity Loader.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 2cbcd9bd46282917f6d83673f8e8b0289d881404ca052249c02054ea81b9de7b
Instruction ID: abf3f41051e4cbc13e3f4675766ef0686fe4adafcc5b827c2961885116325f73
Opcode Fuzzy Hash: 2cbcd9bd46282917f6d83673f8e8b0289d881404ca052249c02054ea81b9de7b
Instruction Fuzzy Hash: EF1128B19002098BDB20EFAAC8457DFBBF5EB48314F108819D519A7340DB78A545CFA1

Function 0215B558 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0215B5BE

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bf3d03ae86d78c6f7e3e078a69c5178161b706cef1fcadce6661074f478fdc28
Instruction ID: df77ea8bb3321812fd347ed8c39380f5ca2660f58ab07f7f367439f5cf8cffd9
Opcode Fuzzy Hash: bf3d03ae86d78c6f7e3e078a69c5178161b706cef1fcadce6661074f478fdc28
Instruction Fuzzy Hash: 6E110FB5C002498FCB14DF9AC544A9EFBF5EF88314F14845AD928A7210D378A645CFA1

Function 054EC6D8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000018,00000001,?), ref: 054EC73D

Memory Dump Source

Source File: 00000000.00000002.2045327792.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Insanity Loader.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 226fb8e4d2367706f20c1827d6d565e9e7c5684ce0712ac336cb767b1022c8ba
Instruction ID: 693eb025a922e3b302ca1b16a3e9a33c4b48405a74699c0782c0324ff647d7d9
Opcode Fuzzy Hash: 226fb8e4d2367706f20c1827d6d565e9e7c5684ce0712ac336cb767b1022c8ba
Instruction Fuzzy Hash: 2611F5B58002499FCB10DF9AC985BDEBBF8EB48310F10845AD518A3310C379A944CFA5

Function 054E8C00 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000018,00000001,?), ref: 054EC73D

Memory Dump Source

Source File: 00000000.00000002.2045327792.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Insanity Loader.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ff25f99506dfb9e278897e4f34d94aeafad64f6c939e34f26e1a6cd2ee0a6ccf
Instruction ID: 03c85172d2475e0b19ed4f1b1b560ebebb8477d6d1a300ef96c4d69ac1069114
Opcode Fuzzy Hash: ff25f99506dfb9e278897e4f34d94aeafad64f6c939e34f26e1a6cd2ee0a6ccf
Instruction Fuzzy Hash: C21103B5800349DFCB10DF9AC985BEEBBF8EB48310F10845AE918A7310C378A944CFA5

Function 056B74B0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 056B750F

Memory Dump Source

Source File: 00000000.00000002.2045623724.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56b0000_Insanity Loader.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 95bd7528f9896a266364dd5034070d160b6d0968a58b339c7071cc2b1a61e462
Instruction ID: 380ab55a98459ffdbe1b371bb73dbaa6c0b858aacfb536fc588db1bc1779f394
Opcode Fuzzy Hash: 95bd7528f9896a266364dd5034070d160b6d0968a58b339c7071cc2b1a61e462
Instruction Fuzzy Hash: 031106B1D002498FDB20DFAAC5457DEFBF5EF88314F208859C519A7240DB79A944CBA1

Function 053A20D0 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 053A2135

Memory Dump Source

Source File: 00000000.00000002.2045179714.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53a0000_Insanity Loader.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 47ea167828eff8e24438a685f36176b44bfe5a6272a69912a6d6952fe5f887be
Instruction ID: 31a55801e6815a84d5a4f89f0794fc9e43032ec66aba6720d0ce10629c45753f
Opcode Fuzzy Hash: 47ea167828eff8e24438a685f36176b44bfe5a6272a69912a6d6952fe5f887be
Instruction Fuzzy Hash: 0511D3BA800249CFDB10DF99D585BDEBBF8EB48324F20841AD959B7750C378A944CFA5

Function 053A20D8 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 053A2135

Memory Dump Source

Source File: 00000000.00000002.2045179714.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53a0000_Insanity Loader.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 21cefbeeec8ba275be93d1449d634b3935d0f9b532287048938819d7bcbf9bc8
Instruction ID: 56b7b3c1f54b3a8fbe20048dd376677569b13d547d9b9f684bbd69015666ec5d
Opcode Fuzzy Hash: 21cefbeeec8ba275be93d1449d634b3935d0f9b532287048938819d7bcbf9bc8
Instruction Fuzzy Hash: 3E11E5B58002499FDB10DF9AD585BDEFBF8EB48320F10841AE919A7350C378A944CFA5

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 0061D4E8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040032176.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3caa9b9d289c9a8c60a87623ef953c8d5280a794c3f054d98f5bce61eef8fdf
Instruction ID: 754e7661b67faf25d34b617843aa38f080e2b3fb07d132cce7935a47b46da46e
Opcode Fuzzy Hash: b3caa9b9d289c9a8c60a87623ef953c8d5280a794c3f054d98f5bce61eef8fdf
Instruction Fuzzy Hash: 6D2103B1500200EFCB05DF14D9C0BA6BF67FB98318F28C569D9090B356C33AD896D6A1

Function 0061D5D4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040032176.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 844fe548248bcc374a8a9e83a7671841c1b084f2205d4fd3b431d71096bae38e
Instruction ID: 77d80b96b41da25cd9812522c728ea2687fd75a1db5329c8c0b41af7edea6568
Opcode Fuzzy Hash: 844fe548248bcc374a8a9e83a7671841c1b084f2205d4fd3b431d71096bae38e
Instruction Fuzzy Hash: AC2121B1500240DFCB05DF14D9C0FA6BFA6FB98314F288169E9090A356C33AD886D6E1

Function 0210D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040527098.000000000210D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0210D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210d000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f871988ee63639792baefb953e45a3d92657636e51781cbc0bb6c697176f1b
Instruction ID: 320cbe902ca040d31d36a79b190f45063753258d1b732d14ffeee6310d7f1648
Opcode Fuzzy Hash: 56f871988ee63639792baefb953e45a3d92657636e51781cbc0bb6c697176f1b
Instruction Fuzzy Hash: 9B210771584304EFDB05DF94E5C0F26BBA5FB8C314F20C56DE9094B296C3BAD806CA61

Function 0210D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040527098.000000000210D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0210D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210d000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed3b8d146bf074811bf64e099f85c9ef41d27d681f5a3940beb847c8131083f
Instruction ID: 420da8bd59a3291ea18aa4ca4deb51691517f26ea40f6315964b0f85482fa5e5
Opcode Fuzzy Hash: aed3b8d146bf074811bf64e099f85c9ef41d27d681f5a3940beb847c8131083f
Instruction Fuzzy Hash: F321F571684204DFDB14DF64E9C4F16BF65EB88314F20C569D94D4B29AC3BAD407CA62

Function 0210D007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040527098.000000000210D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0210D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210d000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d705a0299ffde082b29c72d3358b91a0439dd632b62eb980b075a125e88a8d1c
Instruction ID: 26be5f6a3085edcd1ea452e4998e394a4d1f0c56554e6476fb2999b1e88a5dd4
Opcode Fuzzy Hash: d705a0299ffde082b29c72d3358b91a0439dd632b62eb980b075a125e88a8d1c
Instruction Fuzzy Hash: 31219F755493C08FCB02CF24D9D4B15BF71EB46214F28C5DAD8898F6A7C33A980ACB62

Function 0061D4E3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040032176.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcf16f0ce3997a393d561b9291fa03094e96af132afbef0229708fa6f6a02d1
Instruction ID: 97b71ec512cf803aaa41ea6f1a043fc69ee2df27dc0d87db0474d701106b1926
Opcode Fuzzy Hash: 3fcf16f0ce3997a393d561b9291fa03094e96af132afbef0229708fa6f6a02d1
Instruction Fuzzy Hash: B611B176504240CFCB16CF10D9C4B96BF72FB98314F28C5A9D9090B356C336D85ADBA2

Function 0061D5CF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040032176.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcf16f0ce3997a393d561b9291fa03094e96af132afbef0229708fa6f6a02d1
Instruction ID: 8202271cb1a9b9694c300f3ac62bee2fb88b31f73c6d6801307e74f2a3bc17cb
Opcode Fuzzy Hash: 3fcf16f0ce3997a393d561b9291fa03094e96af132afbef0229708fa6f6a02d1
Instruction Fuzzy Hash: B811E472504240CFCB06CF00D5C4B56BF72FB94314F28C5A9D8490B356C336D856CBA1

Function 0210D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040527098.000000000210D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0210D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_210d000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5635bf6bf0a90c65c6f78b78781ef727195c12e75a23b42f627594c6f222ba
Instruction ID: 5a45da5e46d671f56acca185560fb18c843c6ac1de7862be7db4b0f269fd378b
Opcode Fuzzy Hash: 2c5635bf6bf0a90c65c6f78b78781ef727195c12e75a23b42f627594c6f222ba
Instruction Fuzzy Hash: A411BB75544280DFCB02CF54D5C4B15BBA1FB88214F24C6A9D8494B696C37AD40ACB62

Function 0061D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040032176.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd5697b0f827f9172a12bb37c8631350dfb09a37a1e07f387f9934994a14bc7
Instruction ID: f2db3b6bcfdc93a2476590d1d6575b043bd06bccc74dac37fe5461202427a6b6
Opcode Fuzzy Hash: 2cd5697b0f827f9172a12bb37c8631350dfb09a37a1e07f387f9934994a14bc7
Instruction Fuzzy Hash: FF014C7140E3C09ED7128B258994B92BFB4EF57225F1DC0DBD9888F2A7C2695C49C772

Function 0061D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040032176.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4dec6c58e2040698e86f91d4edd330d1ddf1a0639ab50f7d51fcec762a5930
Instruction ID: ddfc6252b379cfb7b0a08ad5174505b3cab1a6ee543330ac6bc4c028dcacec62
Opcode Fuzzy Hash: ad4dec6c58e2040698e86f91d4edd330d1ddf1a0639ab50f7d51fcec762a5930
Instruction Fuzzy Hash: CF01F771405340AAD7208F19C984BE7BF99EF49321F1CC429ED480B346C2799C82C6B1

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 054ECE88 Relevance: 6.9, Strings: 5, Instructions: 652COMMON

Download Yara Rule

Strings

Haq, xrefs: 054EDA14
Haq, xrefs: 054EDBE3
Haq, xrefs: 054EDA9B
Haq, xrefs: 054EDB25
Haq, xrefs: 054ED981

Memory Dump Source

Source File: 00000000.00000002.2045327792.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Insanity Loader.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$Haq$Haq
API String ID: 0-1792267638
Opcode ID: 0b2fc027b21d79801a39756b6a2eb8d89c45cf7d948e289c7275b8e39df0a07e
Instruction ID: 10a109474e92fbd7db9f6b9d882321ce3a8bc325107236cf441554f9ad92452c
Opcode Fuzzy Hash: 0b2fc027b21d79801a39756b6a2eb8d89c45cf7d948e289c7275b8e39df0a07e
Instruction Fuzzy Hash: 31425070E002188FDB54DFA9C4947AEBBF6AF88301F1485AED409AB395DF349D85CB91

Function 00408C60 Relevance: 4.1, Strings: 3, Instructions: 377COMMON

Download Yara Rule

Strings

@, xrefs: 00408D03
PA, xrefs: 00408E3D
@, xrefs: 00409092

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID:
String ID: @$@$PA
API String ID: 0-3039612711
Opcode ID: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction ID: 284407f43597d2b1529aa5dbb826e4f49811f0ea4eaa41d9cabafce47d44ff82
Opcode Fuzzy Hash: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction Fuzzy Hash: 64E159316083418FC724DF28C58066BB7E1AFD9314F14493EE8C5A7391EB79D949CB8A

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 056B6C18 Relevance: 1.7, Strings: 1, Instructions: 497COMMON

Download Yara Rule

Strings

4|bq, xrefs: 056B7350

Memory Dump Source

Source File: 00000000.00000002.2045623724.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56b0000_Insanity Loader.jbxd

Similarity

API ID:
String ID: 4|bq
API String ID: 0-1932486993
Opcode ID: 132741a3d19d154b84768f7e742031c8281a3942e06d3b6dff73ff8961879fac
Instruction ID: 909f86d5ae2d5459db8bf0c4b6716c1b44183ccb9c3f352ab5d10e6c62dcc33d
Opcode Fuzzy Hash: 132741a3d19d154b84768f7e742031c8281a3942e06d3b6dff73ff8961879fac
Instruction Fuzzy Hash: 2C22BA75E002298FDB68CFA9CC91BEDBBB2BB88300F5481A9D50DA7351DA705E85CF50

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Function 00407C3F Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction ID: d5e3495c9826dce769b252ea72d1bcaf7b5d46a24141b332915225fd3cdae7ad
Opcode Fuzzy Hash: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction Fuzzy Hash: 9852A471A047129FC708CF29C99066AB7E1FF88304F044A3EE896E7B81D739E955CB95

Function 004073A0 Relevance: .6, Instructions: 633COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
Instruction ID: 17d22deff8d32e931318445bbea846c6b698fa6fcc44f6923348d96d7e24b863
Opcode Fuzzy Hash: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
Instruction Fuzzy Hash: 0A329E70A087029FD318CF29C98472AB7E1BF84304F148A3EE89567781D779E955CBDA

Function 00406CA0 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction ID: cc67e10771130af0a5279b37c8f7fa75a2653c997645fd1ae8a0b8309c7f2627
Opcode Fuzzy Hash: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction Fuzzy Hash: 48E1D6306083514FC708CF28C99456ABBE2EFC5304F198A7EE8D68B386D779D94ACB55

Function 053A01D8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045179714.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53a0000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a18a5b1ac631123f7e758437ad2574adadf8b052acec2a83a98d62f2d1d2fdf
Instruction ID: 61dd9c7b669374c8937b9d4657a172c9d7e3773850f0b00c18d7adc08dae0905
Opcode Fuzzy Hash: 1a18a5b1ac631123f7e758437ad2574adadf8b052acec2a83a98d62f2d1d2fdf
Instruction Fuzzy Hash: 7912A8B0C957458BE718CF25EACC1893BB1FB81318FD08A0AD1615B2E9D7B815EADF44

Function 054ED3B0 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045327792.00000000054E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54e0000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472b1fb93c3875fd49fda3d96c04df39eaff7be53446dae7734972a2ecdc8500
Instruction ID: fbf63f8bee19d125a8576145005801956304a63862ac2b009b24597af6165235
Opcode Fuzzy Hash: 472b1fb93c3875fd49fda3d96c04df39eaff7be53446dae7734972a2ecdc8500
Instruction Fuzzy Hash: DFC15F71E002148FCB25DF69C884BDEBBB2BF89305F14C5AAD459AB255DB30D985CF90

Function 0215E17C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb21bc17e6a7deb697416ae79e1f67a3103a2a398d43451d9b0fcd8664e85c4
Instruction ID: c3446a78c94386859bf63021e46f9aca7459060e76d9f3ccfe5d84af66de2af0
Opcode Fuzzy Hash: 8fb21bc17e6a7deb697416ae79e1f67a3103a2a398d43451d9b0fcd8664e85c4
Instruction Fuzzy Hash: 63A19132E50229CFCF09DFB4C98459EB7B2FF85300B1585AAE815AB265DB31E956CF40

Function 053A01C8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045179714.00000000053A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53a0000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97e17076a659aa63c886eb6de4e6216d5e65722324cb479ed6df677141513fb6
Instruction ID: 2f67933b29bad3da7e457187f1a54517000ae07282ae2535b8cfde9ce68759bd
Opcode Fuzzy Hash: 97e17076a659aa63c886eb6de4e6216d5e65722324cb479ed6df677141513fb6
Instruction Fuzzy Hash: DBC10CB0C947458BD718CF65EACC1897BB1FF85318F908A0AD1616B2E8DBB414EACF44

Function 00402B90 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
Instruction ID: 74c1b90a01db230de662c72faab58802bb742d928f34651097fec506a9751401
Opcode Fuzzy Hash: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
Instruction Fuzzy Hash: 15717072A9155347E39CCF5CECD17763713DBC5351F49C23ACA025B6EAC938A922C688

Function 004028B0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction ID: e93c334361593eb17f37b37ed9e80cdb2c00b1b1e1af3e0e9a736190e966ddef
Opcode Fuzzy Hash: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction Fuzzy Hash: 4A615E3266055747E391DF6DEEC47663762EBC9351F18C630CA008B6A6CB39B92297CC

Function 00401650 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction ID: 39afabd8a370e1aacf823bb5b0eb141e0e266d105c364ee31248ba7b153c19f0
Opcode Fuzzy Hash: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction Fuzzy Hash: 2851F94400D7E18EC716873A44E0AA7BFD10FAB115F4E9ACDA5E90B2E3C159C288DB77

Function 00402F20 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
Instruction ID: cff114a85fcb8f5deb46d81d22c4208fa3965af46b01a687ebeadebabb5a60ab
Opcode Fuzzy Hash: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
Instruction Fuzzy Hash: 9A31D8302052028BE738CE19C954BEBB3B5AFC0349F44883ED986A73C4DABDD945D795

Function 02152ECC Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2040882107.0000000002150000.00000040.00000800.00020000.00000000.sdmp, Offset: 02150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2150000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39c472eca11945ff4c8b5f47d2a9ae46389faa88d0647c7af249e2d18603eb0
Instruction ID: 3a15a50bb9e0a8a59e4e5bdfec22f70c3d387030d4a014c8387a04c5e3d7b1bf
Opcode Fuzzy Hash: b39c472eca11945ff4c8b5f47d2a9ae46389faa88d0647c7af249e2d18603eb0
Instruction Fuzzy Hash: 9231A532696271DEC302AF3088944DB77B0D71E2C4B5648DBDD60CB0AADBB5E00EDB91

Function 00402F89 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
Instruction ID: 40597224e526abc728bb10992f322fa75c91b34d76fbbe6bc80328d1c420bfc2
Opcode Fuzzy Hash: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
Instruction Fuzzy Hash: F321923170520247EB68C929C9547ABB3A5ABC0389F48853EC986A73C8DAB9E941D785

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,021B18D8), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b820e78b463918eed32479816903fc70d8532b7c557c67349a3712e4f0fad1ae
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b820e78b463918eed32479816903fc70d8532b7c557c67349a3712e4f0fad1ae
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c4afc057559a022db8f819d9985b866907c7fad8716f86744927840939a860f5
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c4afc057559a022db8f819d9985b866907c7fad8716f86744927840939a860f5
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 0040C73D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Strings

'B, xrefs: 0040C70F

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID: 'B
API String ID: 2805327698-2787509829
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(021B1670), ref: 00414050

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 0040FA58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0040FA7A
__calloc_crt.LIBCMT ref: 0040FA93

Strings

`$B, xrefs: 0040FACC
P$B, xrefs: 0040FAAA

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: __calloc_crt
String ID: P$B$`$B
API String ID: 3494438863-235554963
Opcode ID: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction ID: 4bdca0f49684ef71ac3198dcc3f656e5d5ce7fed137673697bf40858e87bd1f9
Opcode Fuzzy Hash: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction Fuzzy Hash: 6011A3327446115BE7348B1DBD50F662391EB84728BA4423BE619EA7E0E77CD8864A4C

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 004146FA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 0041470C

Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(00000001), ref: 004145E4
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 004145F1
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 004145FE
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 0041460B
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 00414618
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 00414634
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 00414644
Part of subcall function 004145D2: InterlockedIncrement.KERNEL32(?), ref: 0041465A

___removelocaleref.LIBCMT ref: 00414717

Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 0041467B
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 00414688
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 00414695
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146A2
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146AF
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146CB
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(00000000), ref: 004146DB
Part of subcall function 00414661: InterlockedDecrement.KERNEL32(?), ref: 004146F1

___freetlocinfo.LIBCMT ref: 0041472B

Part of subcall function 00414489: ___free_lconv_mon.LIBCMT ref: 004144CF
Part of subcall function 00414489: ___free_lconv_num.LIBCMT ref: 004144F0
Part of subcall function 00414489: ___free_lc_time.LIBCMT ref: 00414575

Strings

@.B, xrefs: 00414722

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: @.B
API String ID: 467427115-470711618
Opcode ID: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction ID: 8e9b8205a585dc9325c25650a27042e0212317e7447dcce9b0fe23aa5a8dd77f
Opcode Fuzzy Hash: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction Fuzzy Hash: BDE0863250192255CE35261D76806EF93A98FD3725B3A017FF864AF7D8EB2C4CC0809D

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 689e5a2a8d0df6628a55ca55f65915ee6a0b33bdec45a2b9390eeacb6c5b01b1
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 689e5a2a8d0df6628a55ca55f65915ee6a0b33bdec45a2b9390eeacb6c5b01b1
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000000.00000002.2039681329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2039659519.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039713106.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039731155.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039751670.0000000000426000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2039786224.0000000000480000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Insanity Loader.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Insanity Loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Insanity Loader.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
Insanity Loader.exe

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Function 053ABD7B Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 341
COMMON

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Function 0215D5F0 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Function 0215D600 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Function 0215B358 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON