Edit tour

Windows Analysis Report
2FnvReiPU6.exe

Overview

General Information

Sample name:	2FnvReiPU6.exe renamed because original name is a hash value
Original sample name:	6c2b21f0366b3942ae23d428155856a3deedccf6dcd00f3e27652a625455367d.exe
Analysis ID:	1508089
MD5:	38497df5caa858a3e65f3946bb0e28bf
SHA1:	2446e498831b099bc15c37c295387e1c049fc702
SHA256:	6c2b21f0366b3942ae23d428155856a3deedccf6dcd00f3e27652a625455367d
Tags:	exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses SMTP (mail sending)

Yara signature match

Classification

Process Tree

System is w10x64

2FnvReiPU6.exe (PID: 7480 cmdline: "C:\Users\user\Desktop\2FnvReiPU6.exe" MD5: 38497DF5CAA858A3E65F3946BB0E28BF)

cmd.exe (PID: 7528 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\crxslmyv\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7580 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\upwtsplm.exe" C:\Windows\SysWOW64\crxslmyv\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7644 cmdline: "C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7704 cmdline: "C:\Windows\System32\sc.exe" description crxslmyv "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7768 cmdline: "C:\Windows\System32\sc.exe" start crxslmyv MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7876 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

upwtsplm.exe (PID: 7836 cmdline: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d"C:\Users\user\Desktop\2FnvReiPU6.exe" MD5: 61C4C37954B064097FFBF48D1D960C6E)

svchost.exe (PID: 7856 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xde95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xde95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: 2FnvReiPU6.exe PID: 7480	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: upwtsplm.exe PID: 7836	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 7856	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.svchost.exe.620000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.svchost.exe.620000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.svchost.exe.620000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.upwtsplm.exe.eb0000.1.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.upwtsplm.exe.eb0000.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.upwtsplm.exe.eb0000.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.2FnvReiPU6.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.2FnvReiPU6.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.2FnvReiPU6.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.upwtsplm.exe.eb0000.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.upwtsplm.exe.eb0000.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.upwtsplm.exe.eb0000.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.3.upwtsplm.exe.d50000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.upwtsplm.exe.d50000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
11.3.upwtsplm.exe.d50000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.3.upwtsplm.exe.d50000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.upwtsplm.exe.d50000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.svchost.exe.620000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.svchost.exe.620000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.svchost.exe.620000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.2FnvReiPU6.exe.720000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.2FnvReiPU6.exe.720000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.2FnvReiPU6.exe.720000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.2FnvReiPU6.exe.720000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.2FnvReiPU6.exe.720000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
11.2.upwtsplm.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.upwtsplm.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.upwtsplm.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 23 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d"C:\Users\user\Desktop\2FnvReiPU6.exe", ParentImage: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe, ParentProcessId: 7836, ParentProcessName: upwtsplm.exe, ProcessCommandLine: svchost.exe, ProcessId: 7856, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\2FnvReiPU6.exe", ParentImage: C:\Users\user\Desktop\2FnvReiPU6.exe, ParentProcessId: 7480, ParentProcessName: 2FnvReiPU6.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7644, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.11.9, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 7856, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d"C:\Users\user\Desktop\2FnvReiPU6.exe", ParentImage: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe, ParentProcessId: 7836, ParentProcessName: upwtsplm.exe, ProcessCommandLine: svchost.exe, ProcessId: 7856, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 7856, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\crxslmyv

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\2FnvReiPU6.exe", ParentImage: C:\Users\user\Desktop\2FnvReiPU6.exe, ParentProcessId: 7480, ParentProcessName: 2FnvReiPU6.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7644, ProcessName: sc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2FnvReiPU6.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\upwtsplm.exe

Avira: detection malicious, Label: HEUR/AGEN.1315385

Multi AV Scanner detection for submitted file

Source: 2FnvReiPU6.exe

ReversingLabs: Detection: 89%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\upwtsplm.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 2FnvReiPU6.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Unpacked PE file: 0.2.2FnvReiPU6.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Unpacked PE file: 11.2.upwtsplm.exe.400000.0.unpack

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\crxslmyv

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.9 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.91 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 173.194.76.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 43.231.4.7 443	Jump to behavior

Source: Joe Sandbox View	IP Address: 98.136.96.91 98.136.96.91
Source: Joe Sandbox View	IP Address: 43.231.4.7 43.231.4.7
Source: Joe Sandbox View	IP Address: 94.100.180.31 94.100.180.31

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: YAHOO-NE1US YAHOO-NE1US
Source: Joe Sandbox View	ASN Name: GIGABIT-MYGigabitHostingSdnBhdMY GIGABIT-MYGigabitHostingSdnBhdMY
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU

Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 52.101.11.9:25
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 98.136.96.91:25
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 173.194.76.27:25
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 94.100.180.31:25

Source: unknown	TCP traffic detected without corresponding DNS query: 43.231.4.7
Source: unknown	TCP traffic detected without corresponding DNS query: 43.231.4.7
Source: unknown	TCP traffic detected without corresponding DNS query: 43.231.4.7
Source: unknown	TCP traffic detected without corresponding DNS query: 43.231.4.7
Source: unknown	TCP traffic detected without corresponding DNS query: 43.231.4.7
Source: unknown	TCP traffic detected without corresponding DNS query: 43.231.4.7
Source: unknown	TCP traffic detected without corresponding DNS query: 43.231.4.7
Source: unknown	TCP traffic detected without corresponding DNS query: 43.231.4.7
Source: unknown	TCP traffic detected without corresponding DNS query: 43.231.4.7
Source: unknown	TCP traffic detected without corresponding DNS query: 43.231.4.7
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta7.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 12.2.svchost.exe.620000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.upwtsplm.exe.eb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2FnvReiPU6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.upwtsplm.exe.eb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.upwtsplm.exe.d50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2FnvReiPU6.exe.720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.upwtsplm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2FnvReiPU6.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: upwtsplm.exe PID: 7836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7856, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.svchost.exe.620000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.svchost.exe.620000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.upwtsplm.exe.eb0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.upwtsplm.exe.eb0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.2FnvReiPU6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.2FnvReiPU6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.upwtsplm.exe.eb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.upwtsplm.exe.eb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.3.upwtsplm.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.upwtsplm.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.3.upwtsplm.exe.d50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.upwtsplm.exe.d50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.svchost.exe.620000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.svchost.exe.620000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.2FnvReiPU6.exe.720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.2FnvReiPU6.exe.720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.2FnvReiPU6.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.2FnvReiPU6.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.upwtsplm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.upwtsplm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\crxslmyv\

Jump to behavior

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Code function: 11_2_0040C913	11_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_0062C913	12_2_0062C913

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Code function: String function: 00402544 appears 53 times

Source: 12.2.svchost.exe.620000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.svchost.exe.620000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.upwtsplm.exe.eb0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.upwtsplm.exe.eb0000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.2FnvReiPU6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.2FnvReiPU6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.upwtsplm.exe.eb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.upwtsplm.exe.eb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.3.upwtsplm.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.upwtsplm.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.3.upwtsplm.exe.d50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.upwtsplm.exe.d50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.svchost.exe.620000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.svchost.exe.620000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.2FnvReiPU6.exe.720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.2FnvReiPU6.exe.720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.2FnvReiPU6.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.2FnvReiPU6.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.upwtsplm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.upwtsplm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: classification engine

Classification label: mal100.troj.evad.winEXE@22/3@8/5

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00629A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00629A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

File created: C:\Users\user\AppData\Local\Temp\upwtsplm.exe

Jump to behavior

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2FnvReiPU6.exe

ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

File read: C:\Users\user\Desktop\2FnvReiPU6.exe

Jump to behavior

Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_11-6915

Source: unknown	Process created: C:\Users\user\Desktop\2FnvReiPU6.exe "C:\Users\user\Desktop\2FnvReiPU6.exe"
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\crxslmyv\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\upwtsplm.exe" C:\Windows\SysWOW64\crxslmyv\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description crxslmyv "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start crxslmyv
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d"C:\Users\user\Desktop\2FnvReiPU6.exe"
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\crxslmyv\	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\upwtsplm.exe" C:\Windows\SysWOW64\crxslmyv\	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description crxslmyv "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start crxslmyv	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: modemui.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: uniplat.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: ??????.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: ewqzafg.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Section loaded: modemui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Section loaded: uniplat.dll	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Section loaded: ??????.dll	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Section loaded: ewqzafg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: 2FnvReiPU6.exe

Static file information: File size 14534144 > 1048576

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Unpacked PE file: 0.2.2FnvReiPU6.exe.400000.0.unpack .text:ER;.pdata:W;.bdata:W;.rsrc:W;.relos:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Unpacked PE file: 11.2.upwtsplm.exe.400000.0.unpack .text:ER;.pdata:W;.bdata:W;.rsrc:W;.relos:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Unpacked PE file: 0.2.2FnvReiPU6.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Unpacked PE file: 11.2.upwtsplm.exe.400000.0.unpack

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	File created: C:\Users\user\AppData\Local\Temp\upwtsplm.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crxslmyv

Jump to behavior

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\2fnvreipu6.exe

Jump to behavior

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00401000 LoadLibraryA,CloseHandle,GetShortPathNameW,GetProcAddress,CloseHandle,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

12_2_0062199C

Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_11-7342
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-7240
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-7854

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_12-6142

Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_11-7300
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-7229
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-7331

Source: C:\Windows\SysWOW64\svchost.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_12-7434

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-6799
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_11-6930

Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe

API coverage: 8.5 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 7860	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7952	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7952	Thread sleep time: -38000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: C:\Windows\SysWOW64\svchost.exe

Thread delayed: delay time: 30000

Jump to behavior

Source: svchost.exe, 0000000C.00000002.2951512356.0000000000A00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	API call chain: ExitProcess graph end node			graph_0-7231
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	API call chain: ExitProcess graph end node			graph_11-7302

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe

Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep

graph_12-7669

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Code function: 0_2_006F007E push dword ptr fs:[00000030h]	0_2_006F007E
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Code function: 0_2_006F03CC push dword ptr fs:[00000030h]	0_2_006F03CC
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Code function: 0_2_0071007E push dword ptr fs:[00000030h]	0_2_0071007E
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Code function: 0_2_007103CC push dword ptr fs:[00000030h]	0_2_007103CC
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Code function: 11_2_0098007E push dword ptr fs:[00000030h]	11_2_0098007E
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Code function: 11_2_009803CC push dword ptr fs:[00000030h]	11_2_009803CC
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Code function: 11_2_00D4007E push dword ptr fs:[00000030h]	11_2_00D4007E
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Code function: 11_2_00D403CC push dword ptr fs:[00000030h]	11_2_00D403CC

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_0040EC2E GetProcessHeap,RtlFreeHeap,

0_2_0040EC2E

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_00629A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00629A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.9 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.91 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 173.194.76.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 43.231.4.7 443	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 620000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 620000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 620000			Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 43A008			Jump to behavior

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\crxslmyv\	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\upwtsplm.exe" C:\Windows\SysWOW64\crxslmyv\	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description crxslmyv "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start crxslmyv	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

0_2_00407809

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\2FnvReiPU6.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 12.2.svchost.exe.620000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.upwtsplm.exe.eb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2FnvReiPU6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.upwtsplm.exe.eb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.upwtsplm.exe.d50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2FnvReiPU6.exe.720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.upwtsplm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2FnvReiPU6.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: upwtsplm.exe PID: 7836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7856, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 12.2.svchost.exe.620000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.upwtsplm.exe.eb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2FnvReiPU6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.upwtsplm.exe.eb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.upwtsplm.exe.d50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2FnvReiPU6.exe.720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.upwtsplm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2FnvReiPU6.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: upwtsplm.exe PID: 7836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7856, type: MEMORYSTR

Source: C:\Users\user\Desktop\2FnvReiPU6.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe	Code function: 11_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	11_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 12_2_006288B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_006288B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	2 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	111 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	111 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
2FnvReiPU6.exe	89%	ReversingLabs	Win32.Trojan.Emotet
2FnvReiPU6.exe	100%	Avira	HEUR/AGEN.1315385
2FnvReiPU6.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\upwtsplm.exe	100%	Avira	HEUR/AGEN.1315385
C:\Users\user\AppData\Local\Temp\upwtsplm.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
mxs.mail.ru	94.100.180.31	true	true	unknown
mta7.am0.yahoodns.net	98.136.96.91	true	true	unknown
microsoft-com.mail.protection.outlook.com	52.101.11.9	true	true	unknown
smtp.google.com	173.194.76.27	true	false	unknown
google.com	unknown	unknown	true	unknown
yahoo.com	unknown	unknown	true	unknown
mail.ru	unknown	unknown	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
173.194.76.27	smtp.google.com	United States	15169	GOOGLEUS	false
52.101.11.9	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
98.136.96.91	mta7.am0.yahoodns.net	United States	36646	YAHOO-NE1US	true
43.231.4.7	unknown	Malaysia	55720	GIGABIT-MYGigabitHostingSdnBhdMY	true
94.100.180.31	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1508089
Start date and time:	2024-09-09 17:02:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2FnvReiPU6.exe renamed because original name is a hash value
Original Sample Name:	6c2b21f0366b3942ae23d428155856a3deedccf6dcd00f3e27652a625455367d.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@22/3@8/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 67 Number of non-executed functions: 175
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.236.44.162, 20.76.201.171, 20.112.250.133, 20.70.246.20, 20.231.239.246
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 2FnvReiPU6.exe

Simulations

Behavior and APIs

Time	Type	Description
11:03:52	API Interceptor	11x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
98.136.96.91	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
	rpzOeQ5QzX.exe	Get hash	malicious	Tofsee	Browse
	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	.exe	Get hash	malicious	Unknown	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	message.txt.exe	Get hash	malicious	Unknown	Browse
	test.dat.exe	Get hash	malicious	Unknown	Browse
43.231.4.7	W4KtaS5yf1.exe	Get hash	malicious	Tofsee	Browse
	1.exe	Get hash	malicious	Tofsee	Browse
	PyIi6pkq8F.exe	Get hash	malicious	Tofsee	Browse
	fJQWVp3S5r.exe	Get hash	malicious	Tofsee	Browse
	3gsDd2imbR.exe	Get hash	malicious	Tofsee	Browse
	4MFtS7taNz	Get hash	malicious	Tofsee	Browse
	fuZcDWJRoP.exe	Get hash	malicious	Tofsee	Browse
	verybig.exe	Get hash	malicious	Tofsee	Browse
	mycoolnewscreensaver.exe	Get hash	malicious	Tofsee	Browse
	W7TVCSXI5O.exe	Get hash	malicious	Tofsee	Browse
94.100.180.31	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse
	vekvtia.exe	Get hash	malicious	Tofsee	Browse
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
	setup.exe	Get hash	malicious	Tofsee	Browse
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mxs.mail.ru	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
microsoft-com.mail.protection.outlook.com	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
mta7.am0.yahoodns.net	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	67.195.204.74
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	67.195.228.111
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse	67.195.204.77
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	setup.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse	67.195.204.77
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse	67.195.204.74
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GIGABIT-MYGigabitHostingSdnBhdMY	http://www.3659ggg.net/	Get hash	malicious	Unknown	Browse	103.198.200.7
	SecuriteInfo.com.Linux.Siggen.9999.17528.22528.elf	Get hash	malicious	Mirai	Browse	172.93.165.119
	win1.exe	Get hash	malicious	Unknown	Browse	103.144.139.186
	94.156.67.132-skid.mpsl-2024-07-30T18_34_38.elf	Get hash	malicious	Mirai, Moobot	Browse	172.93.165.113
	6ddrUd6iQo.exe	Get hash	malicious	FormBook	Browse	103.71.177.176
	http://oveman-austral.com/	Get hash	malicious	Unknown	Browse	103.198.200.1
	http://capitalhillblue.com/	Get hash	malicious	Unknown	Browse	103.198.200.1
	http://3115ll.me/	Get hash	malicious	Unknown	Browse	103.198.200.1
	LisectAVT_2403002B_22.exe	Get hash	malicious	Young Lotus	Browse	202.9.39.96
	LisectAVT_2403002B_22.exe	Get hash	malicious	Young Lotus	Browse	202.9.39.96
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://b00gjbzv.r.us-west-2.awstrack.me/L0/https://www.tiktok.com/////link/v2?aid=1988&lang=enpihd7s&scene=bio_url&target=google.com.////amp/s/karlandrade.com/dayo/apmvx/%5B$%E3%80%82/YWNhYmVyb0BidXJuc21jZC5jb20=/1/01010191d7358f23-01744765-7af5-4eed-8446-de1b584459e4-000000/m-sFuLTWhbEYMC52sHOqVlTWLLE=391	Get hash	malicious	HTMLPhisher	Browse	52.97.189.98
	https://1drv.ms/o/s!BDwGtOL3Ob0ShF7R9UYMfic1EmBo?e=xcw67NPIpE-D6DjdNd9CDg&at=9	Get hash	malicious	HTMLPhisher	Browse	52.108.11.12
	https://myworkspace10fa5.myclickfunnels.com/onlinereview--00e63?preview=true	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://imperosolutions-my.sharepoint.com/personal/jdoyle_imperosoftware_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjdoyle%5Fimperosoftware%5Fcom%2FDocuments%2FEd%20Pro%20MSIs%2FClassMgt%5FRIO%20RANCHO%20PUBLIC%20SCHOOL%20DIST%5FImperoClientSetup8626%2Emsi&parent=%2Fpersonal%2Fjdoyle%5Fimperosoftware%5Fcom%2FDocuments%2FEd%20Pro%20MSIs&ga=1	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	Ln3Yc2X66g.exe	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	https://emea.dcv.ms/y0CiMKVFMD	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://navexglobal.navexone.com/content/dotNet/documents/?docid=9960&public=true	Get hash	malicious	Unknown	Browse	52.108.8.12
	Play_VM-Now(Motcasereviewteam)CQDM.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	Zen Desk Follow Up-20240905_140238-Meeting Recording.mp4.html	Get hash	malicious	HTMLPhisher	Browse	13.107.253.42
	https://skalldyr-my.sharepoint.com/:o:/p/post/EtdITQs4FcRGgNgd61rFkBIBoV1oMjyUbwcDJQUAXGgzAA?e=dpLrAe	Get hash	malicious	Unknown	Browse	52.108.10.12
YAHOO-NE1US	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	98.136.96.75
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	.exe	Get hash	malicious	Unknown	Browse	98.136.96.76
	VvlYJBzLuW.elf	Get hash	malicious	Mirai	Browse	216.252.107.64
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	setup.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	botx.arm.elf	Get hash	malicious	Mirai	Browse	98.138.56.151
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	98.136.96.75
MAILRU-ASMailRuRU	OuZGkt7xKK.exe	Get hash	malicious	Coinhive, Xmrig	Browse	178.237.20.50
	OuZGkt7xKK.exe	Get hash	malicious	Coinhive, Xmrig	Browse	178.237.20.50
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150

Process:	C:\Users\user\Desktop\2FnvReiPU6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13543424
Entropy (8bit):	6.756597985941956
Encrypted:	false
SSDEEP:	12288:vzpKS0FRvqPKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK:dMS
MD5:	61C4C37954B064097FFBF48D1D960C6E
SHA1:	09C10E4C4C796D36DD9B42F8ECCF3685612D28B5
SHA-256:	A9BC78D9B70AB33DF1AF6180D4B3E9389BF2E4309E12A864AA41700E87529D31
SHA-512:	E2467EC816119E6ACAA39FADDE6965A64C5816E00DC209C740125E09DE662833FF6E5FB26B8B631880E615FD3CC669C3CDAC6642996A50AA3CA6745D453FC3F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......P.................F...@...............`....@..................................t....@.................................<...P.......`...........................................................................................................text....D.......F.....................`.pdata...)...`...*...J..............@....bdata...............t..............@....rsrc...`............z...................relos...........(.....................B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13543424
Entropy (8bit):	6.756597985941956
Encrypted:	false
SSDEEP:	12288:vzpKS0FRvqPKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK:dMS
MD5:	61C4C37954B064097FFBF48D1D960C6E
SHA1:	09C10E4C4C796D36DD9B42F8ECCF3685612D28B5
SHA-256:	A9BC78D9B70AB33DF1AF6180D4B3E9389BF2E4309E12A864AA41700E87529D31
SHA-512:	E2467EC816119E6ACAA39FADDE6965A64C5816E00DC209C740125E09DE662833FF6E5FB26B8B631880E615FD3CC669C3CDAC6642996A50AA3CA6745D453FC3F9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......P.................F...@...............`....@..................................t....@.................................<...P.......`...........................................................................................................text....D.......F.....................`.pdata...)...`...*...J..............@....bdata...............t..............@....rsrc...`............z...................relos...........(.....................B........................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.755672206082449
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2FnvReiPU6.exe
File size:	14'534'144 bytes
MD5:	38497df5caa858a3e65f3946bb0e28bf
SHA1:	2446e498831b099bc15c37c295387e1c049fc702
SHA256:	6c2b21f0366b3942ae23d428155856a3deedccf6dcd00f3e27652a625455367d
SHA512:	a172f7b7b005a72069cab497a0b3dfb79badf1b899e990c959eb0b830db4a91250c137e8e5fdf74920ca59a2ede93de39a7f85b774fe7342c1f228ab4b15bf86
SSDEEP:	12288:KzpKS0FRvqPKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKn:oMS
TLSH:	15E65B56847EAB73D5000D3D90DBFFD7122CFAE053588A53AE4640C36E5C6294AF786B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......P.................F...@...............`....@..................................t....@................................

File Icon


Icon Hash:	90cececece8e8eb0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 9, 2024 17:03:10.944856882 CEST	49731	25	192.168.2.4	52.101.11.9
Sep 9, 2024 17:03:11.950920105 CEST	49731	25	192.168.2.4	52.101.11.9
Sep 9, 2024 17:03:13.670233011 CEST	49732	443	192.168.2.4	43.231.4.7
Sep 9, 2024 17:03:13.670273066 CEST	443	49732	43.231.4.7	192.168.2.4
Sep 9, 2024 17:03:13.670399904 CEST	49732	443	192.168.2.4	43.231.4.7
Sep 9, 2024 17:03:13.950895071 CEST	49731	25	192.168.2.4	52.101.11.9
Sep 9, 2024 17:03:17.966559887 CEST	49731	25	192.168.2.4	52.101.11.9
Sep 9, 2024 17:03:25.982269049 CEST	49731	25	192.168.2.4	52.101.11.9
Sep 9, 2024 17:03:30.967506886 CEST	49739	25	192.168.2.4	98.136.96.91
Sep 9, 2024 17:03:31.982279062 CEST	49739	25	192.168.2.4	98.136.96.91
Sep 9, 2024 17:03:33.982255936 CEST	49739	25	192.168.2.4	98.136.96.91
Sep 9, 2024 17:03:37.982223988 CEST	49739	25	192.168.2.4	98.136.96.91
Sep 9, 2024 17:03:45.982304096 CEST	49739	25	192.168.2.4	98.136.96.91
Sep 9, 2024 17:03:50.999453068 CEST	49740	25	192.168.2.4	173.194.76.27
Sep 9, 2024 17:03:51.997958899 CEST	49740	25	192.168.2.4	173.194.76.27
Sep 9, 2024 17:03:53.685575962 CEST	49732	443	192.168.2.4	43.231.4.7
Sep 9, 2024 17:03:53.685647964 CEST	443	49732	43.231.4.7	192.168.2.4
Sep 9, 2024 17:03:53.685715914 CEST	49732	443	192.168.2.4	43.231.4.7
Sep 9, 2024 17:03:53.795072079 CEST	49741	443	192.168.2.4	43.231.4.7
Sep 9, 2024 17:03:53.795120955 CEST	443	49741	43.231.4.7	192.168.2.4
Sep 9, 2024 17:03:53.795303106 CEST	49741	443	192.168.2.4	43.231.4.7
Sep 9, 2024 17:03:54.013524055 CEST	49740	25	192.168.2.4	173.194.76.27
Sep 9, 2024 17:03:58.029043913 CEST	49740	25	192.168.2.4	173.194.76.27
Sep 9, 2024 17:04:06.029083014 CEST	49740	25	192.168.2.4	173.194.76.27
Sep 9, 2024 17:04:11.023190975 CEST	49743	25	192.168.2.4	94.100.180.31
Sep 9, 2024 17:04:12.031671047 CEST	49743	25	192.168.2.4	94.100.180.31
Sep 9, 2024 17:04:14.044939041 CEST	49743	25	192.168.2.4	94.100.180.31
Sep 9, 2024 17:04:18.044831991 CEST	49743	25	192.168.2.4	94.100.180.31
Sep 9, 2024 17:04:26.060358047 CEST	49743	25	192.168.2.4	94.100.180.31
Sep 9, 2024 17:04:33.795005083 CEST	49741	443	192.168.2.4	43.231.4.7
Sep 9, 2024 17:04:33.795089960 CEST	443	49741	43.231.4.7	192.168.2.4
Sep 9, 2024 17:04:33.795155048 CEST	49741	443	192.168.2.4	43.231.4.7
Sep 9, 2024 17:04:33.904696941 CEST	49744	443	192.168.2.4	43.231.4.7
Sep 9, 2024 17:04:33.904752970 CEST	443	49744	43.231.4.7	192.168.2.4
Sep 9, 2024 17:04:33.905046940 CEST	49744	443	192.168.2.4	43.231.4.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 9, 2024 17:03:10.696655035 CEST	64255	53	192.168.2.4	1.1.1.1
Sep 9, 2024 17:03:10.944004059 CEST	53	64255	1.1.1.1	192.168.2.4
Sep 9, 2024 17:03:30.951937914 CEST	51090	53	192.168.2.4	1.1.1.1
Sep 9, 2024 17:03:30.958936930 CEST	53	51090	1.1.1.1	192.168.2.4
Sep 9, 2024 17:03:30.959556103 CEST	55213	53	192.168.2.4	1.1.1.1
Sep 9, 2024 17:03:30.966983080 CEST	53	55213	1.1.1.1	192.168.2.4
Sep 9, 2024 17:03:50.982918978 CEST	61634	53	192.168.2.4	1.1.1.1
Sep 9, 2024 17:03:50.990212917 CEST	53	61634	1.1.1.1	192.168.2.4
Sep 9, 2024 17:03:50.991153955 CEST	52109	53	192.168.2.4	1.1.1.1
Sep 9, 2024 17:03:50.998955965 CEST	53	52109	1.1.1.1	192.168.2.4
Sep 9, 2024 17:04:10.998724937 CEST	52715	53	192.168.2.4	1.1.1.1
Sep 9, 2024 17:04:11.006895065 CEST	53	52715	1.1.1.1	192.168.2.4
Sep 9, 2024 17:04:11.007623911 CEST	53523	53	192.168.2.4	1.1.1.1
Sep 9, 2024 17:04:11.022620916 CEST	53	53523	1.1.1.1	192.168.2.4
Sep 9, 2024 17:05:11.348786116 CEST	58720	53	192.168.2.4	1.1.1.1
Sep 9, 2024 17:05:11.383241892 CEST	53	58720	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 9, 2024 17:03:10.696655035 CEST	192.168.2.4	1.1.1.1	0x96a9	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:30.951937914 CEST	192.168.2.4	1.1.1.1	0x6222	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Sep 9, 2024 17:03:30.959556103 CEST	192.168.2.4	1.1.1.1	0x4140	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:50.982918978 CEST	192.168.2.4	1.1.1.1	0x140a	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Sep 9, 2024 17:03:50.991153955 CEST	192.168.2.4	1.1.1.1	0x789c	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:04:10.998724937 CEST	192.168.2.4	1.1.1.1	0x9f31	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Sep 9, 2024 17:04:11.007623911 CEST	192.168.2.4	1.1.1.1	0xa793	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:05:11.348786116 CEST	192.168.2.4	1.1.1.1	0xf99b	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 9, 2024 17:03:10.944004059 CEST	1.1.1.1	192.168.2.4	0x96a9	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.9	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:10.944004059 CEST	1.1.1.1	192.168.2.4	0x96a9	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.0	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:10.944004059 CEST	1.1.1.1	192.168.2.4	0x96a9	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.41.22	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:10.944004059 CEST	1.1.1.1	192.168.2.4	0x96a9	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.7	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:30.958936930 CEST	1.1.1.1	192.168.2.4	0x6222	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 9, 2024 17:03:30.958936930 CEST	1.1.1.1	192.168.2.4	0x6222	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 9, 2024 17:03:30.958936930 CEST	1.1.1.1	192.168.2.4	0x6222	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 9, 2024 17:03:30.966983080 CEST	1.1.1.1	192.168.2.4	0x4140	No error (0)	mta7.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:30.966983080 CEST	1.1.1.1	192.168.2.4	0x4140	No error (0)	mta7.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:30.966983080 CEST	1.1.1.1	192.168.2.4	0x4140	No error (0)	mta7.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:30.966983080 CEST	1.1.1.1	192.168.2.4	0x4140	No error (0)	mta7.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:30.966983080 CEST	1.1.1.1	192.168.2.4	0x4140	No error (0)	mta7.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:30.966983080 CEST	1.1.1.1	192.168.2.4	0x4140	No error (0)	mta7.am0.yahoodns.net	67.195.204.79	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:30.966983080 CEST	1.1.1.1	192.168.2.4	0x4140	No error (0)	mta7.am0.yahoodns.net	67.195.228.110	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:30.966983080 CEST	1.1.1.1	192.168.2.4	0x4140	No error (0)	mta7.am0.yahoodns.net	67.195.204.72	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:50.990212917 CEST	1.1.1.1	192.168.2.4	0x140a	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Sep 9, 2024 17:03:50.998955965 CEST	1.1.1.1	192.168.2.4	0x789c	No error (0)	smtp.google.com	173.194.76.27	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:50.998955965 CEST	1.1.1.1	192.168.2.4	0x789c	No error (0)	smtp.google.com	74.125.133.26	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:50.998955965 CEST	1.1.1.1	192.168.2.4	0x789c	No error (0)	smtp.google.com	74.125.133.27	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:50.998955965 CEST	1.1.1.1	192.168.2.4	0x789c	No error (0)	smtp.google.com	108.177.15.26	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:03:50.998955965 CEST	1.1.1.1	192.168.2.4	0x789c	No error (0)	smtp.google.com	108.177.15.27	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:04:11.006895065 CEST	1.1.1.1	192.168.2.4	0x9f31	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Sep 9, 2024 17:04:11.022620916 CEST	1.1.1.1	192.168.2.4	0xa793	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:04:11.022620916 CEST	1.1.1.1	192.168.2.4	0xa793	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:05:11.383241892 CEST	1.1.1.1	192.168.2.4	0xf99b	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:05:11.383241892 CEST	1.1.1.1	192.168.2.4	0xf99b	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:05:11.383241892 CEST	1.1.1.1	192.168.2.4	0xf99b	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Sep 9, 2024 17:05:11.383241892 CEST	1.1.1.1	192.168.2.4	0xf99b	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:03:05
Start date:	09/09/2024
Path:	C:\Users\user\Desktop\2FnvReiPU6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2FnvReiPU6.exe"
Imagebase:	0x400000
File size:	14'534'144 bytes
MD5 hash:	38497DF5CAA858A3E65F3946BB0E28BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.1707509611.0000000000720000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:03:06
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\crxslmyv\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:03:06
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:03:06
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\upwtsplm.exe" C:\Windows\SysWOW64\crxslmyv\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:03:06
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:03:07
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create crxslmyv binPath= "C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d\"C:\Users\user\Desktop\2FnvReiPU6.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xd30000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:03:07
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:03:08
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description crxslmyv "wifi internet conection"
Imagebase:	0xd30000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:03:08
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x890000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:03:08
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start crxslmyv
Imagebase:	0xd30000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:03:08
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:03:08
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe /d"C:\Users\user\Desktop\2FnvReiPU6.exe"
Imagebase:	0x400000
File size:	13'543'424 bytes
MD5 hash:	61C4C37954B064097FFBF48D1D960C6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000002.1736760587.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000003.1735876774.0000000000D50000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:03:08
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0xf80000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	11:03:09
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:03:09
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	21.9%
Total number of Nodes:	1852
Total number of Limit Nodes:	20

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00007530), ref: 0040A4C3

Strings

", xrefs: 0040A189
P, xrefs: 00409DAA
", xrefs: 0040A078
%X%08X, xrefs: 0040A0B0
\, xrefs: 00409D0C
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 00409EDB
D, xrefs: 00409F8E

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: ee29fb71c8483b9b793647ea3264c5355c6b8cc509331a95fd3885054cfcc0e0
Instruction ID: 3585989bbaedd28a73b270bd9bf1875f0a43ee57e8055613748a08816c1e76ab
Opcode Fuzzy Hash: ee29fb71c8483b9b793647ea3264c5355c6b8cc509331a95fd3885054cfcc0e0
Instruction Fuzzy Hash: 585292B1C40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6789E948B69

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
CloseHandle.KERNELBASE(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtDuplicateToken, xrefs: 004011F3
NtSetInformationThread, xrefs: 00401155
NtClose, xrefs: 004011B4
RtlSetLastWin32Error, xrefs: 004010D6
NtQueryInformationToken, xrefs: 00401262
NtSetInformationToken, xrefs: 00401175
ntdll.dll, xrefs: 0040100D
NtTerminateProcess, xrefs: 004010F6
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlFreeSid, xrefs: 00401116
RtlLengthSid, xrefs: 00401246
NtFilterToken, xrefs: 0040122B
RtlNtStatusToDosError, xrefs: 00401194
RtlInitUnicodeString, xrefs: 00401135
NtOpenProcessToken, xrefs: 004011D4

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: AddressProc$CloseHandleLibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2326521279-3228201535
Opcode ID: 4374d5bc11ca1c2fa60be4766612f3b99720bc46af73de5be8a6125bd1a76152
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 4374d5bc11ca1c2fa60be4766612f3b99720bc46af73de5be8a6125bd1a76152
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: f08e4a66b1d8eb56d3ad1f8584b36153d56304273cbc9e31910b95c3030bd838
Instruction ID: e1b414ac2acd800f86155b9566517fe94806afef677b15be1bf33dae74c6658f
Opcode Fuzzy Hash: f08e4a66b1d8eb56d3ad1f8584b36153d56304273cbc9e31910b95c3030bd838
Instruction Fuzzy Hash: 33A181B2540208BBEB21DFA1DC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID: PromptOnSecureDesktop
API String ID: 3188212458-2980165447
Opcode ID: e3959d8a0c931ef24a73e9a1ea7033e807417735a7f73b2997be16ea63ab6e7a
Instruction ID: 1851fce060154b14ea5ec5bf2ccd3ef97631883a8962a6cabbb456f8c1490fb9
Opcode Fuzzy Hash: e3959d8a0c931ef24a73e9a1ea7033e807417735a7f73b2997be16ea63ab6e7a
Instruction Fuzzy Hash: 4731F1B2900208BFDB00DFA09D44ADFBF79EF48310F158076E512F7291D674AA618F69

Function 0071007E Relevance: 7.6, APIs: 5, Instructions: 131
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007105D0: VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00710093), ref: 007105DD

VirtualProtect.KERNELBASE(?,?,00000004,?,?), ref: 007100C4
VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,00000004,?,?), ref: 007100D4
VirtualProtect.KERNELBASE(?,?,00000004,?,?,?,?,00000000,?,00000000,?,00000002,?,?,?,00000004), ref: 0071011D
VirtualProtect.KERNELBASE(00000004,?,?,?,?,00000000,?,00000000,?,00000002,?,?,?,00000004,?,?), ref: 00710133
VirtualFree.KERNELBASE(?,00004000,00000002,?,?,?,00000004,?,?), ref: 00710198

Memory Dump Source

Source File: 00000000.00000002.1739553841.0000000000710000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_2FnvReiPU6.jbxd

Similarity

API ID: Virtual$Protect$AllocFree
String ID:
API String ID: 3729553426-0
Opcode ID: b4ea57e9c5b474e0a01886bed018e1aaea45c2fe781a12c9dc45aeed4f903f47
Instruction ID: 8050fa6227a20f08d191be4e4505a9502cafe0d54fdf228946a5ff393faed85c
Opcode Fuzzy Hash: b4ea57e9c5b474e0a01886bed018e1aaea45c2fe781a12c9dc45aeed4f903f47
Instruction Fuzzy Hash: BF418272200104EFD710AF28C849FEAB7A5EF44720F254519F8059B692C7B9ECC1DBE0

Function 0040EC2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040EBA0: GetProcessHeap.KERNEL32(00000000,00000000,0040EC0A,00000000,80000001,?,0040DB55,7FFF0001), ref: 0040EBAD
Part of subcall function 0040EBA0: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBB4

GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
RtlFreeHeap.NTDLL(00000000), ref: 0040EC48

Strings

'@, xrefs: 0040EC2F, 0040EC37, 0040EC3E

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID: '@
API String ID: 1305341483-3530194223
Opcode ID: 08c81c03a0a7108d9ac838324103417e26cacd08bf8f2d3cca78d1ae5343ebed
Instruction ID: 2d0ac8bb9d02bc94818634b60920d143dc176b06b32ab47b2cd542b2b5f2599d
Opcode Fuzzy Hash: 08c81c03a0a7108d9ac838324103417e26cacd08bf8f2d3cca78d1ae5343ebed
Instruction Fuzzy Hash: 3AC012324062307BD5512751BC0DFDB7B28AF45711F0D481AF40576194C7BD588046ED

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(00000000,00000000,PromptOnSecureDesktop,00000000,0040733D,00000000), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 293dfb801b0d4665576106c5a1887ea473dc781c8fdaf55f1d5b1f1ba08ffc92
Instruction ID: 1fe726b284cde181daef39815de7f37c4bbd18f96b62320efe93ab81be9ef980
Opcode Fuzzy Hash: 293dfb801b0d4665576106c5a1887ea473dc781c8fdaf55f1d5b1f1ba08ffc92
Instruction Fuzzy Hash: FEC1F171D04209ABEB119BA5DC45BEF7BB9EF44310F1004B7F504B71D1EA78AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 330
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(00000000,00000000,PromptOnSecureDesktop,00000000,0040733D,00000000), ref: 0040F1AD

Strings

", xrefs: 00407227
, xrefs: 00407194
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 2c1a7a5e27a45d9024ae5e8b0fc79a4811596a6e22ca9665a21b83de94bf1e77
Instruction ID: 74598ce6d8ea9c8d39eff0b1fc7e26e3f0ef6396efd0c92e31e65397aa2b09b2
Opcode Fuzzy Hash: 2c1a7a5e27a45d9024ae5e8b0fc79a4811596a6e22ca9665a21b83de94bf1e77
Instruction Fuzzy Hash: 17B17E71C0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501B61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
CloseHandle.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: 64f94f97fc7a2fc36851443ee948ec9bf9619d76a0d0eb5e6a7564e87e4dadd6
Instruction ID: e7d34e2afa9736079c4f2b655464ed4410373cfc52d7b7bacd72a574a3edd52e
Opcode Fuzzy Hash: 64f94f97fc7a2fc36851443ee948ec9bf9619d76a0d0eb5e6a7564e87e4dadd6
Instruction Fuzzy Hash: CA018F7294020877EA102F62EC4BF9F7F1DEB44718F00883AF619790D2D9B995609A6C

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 007101D1 Relevance: 4.6, APIs: 3, Instructions: 68
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,?,?,?,00000004,?,?), ref: 007101F5
VirtualProtect.KERNELBASE(?,?,00000004,?,00000000,?,00000000,?,?,?,00000004,?,?), ref: 00710212
VirtualProtect.KERNELBASE(?,00000000,?,?,?,00000000,?,?,?,00000004,?,?), ref: 0071024B

Memory Dump Source

Source File: 00000000.00000002.1739553841.0000000000710000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_2FnvReiPU6.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: df0d4710188bbc4545ffb25a3de640365ec90d346391f8a801651d14009fcf39
Instruction ID: 1ac45a230ec72495ae84957549aa643011c886b4d1ba0f4b6982d3a1158a027b
Opcode Fuzzy Hash: df0d4710188bbc4545ffb25a3de640365ec90d346391f8a801651d14009fcf39
Instruction Fuzzy Hash: 98118F726002106BEB214E19CC48ABBB7ACFF45721B15451DFD2AE7280D6B9ED8446E1

Function 004050DC Relevance: 4.0, APIs: 3, Instructions: 253
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404BD1: GetTickCount.KERNEL32 ref: 00404BDD
Part of subcall function 00404BD1: InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

lstrcmpA.KERNEL32(-00000010,00000000,?,00000000), ref: 00405114
lstrcpyA.KERNEL32(-00000010,?,?), ref: 00405253
lstrcmpA.KERNEL32(-00000010,00000000,-00000010,?,?,?,?,?), ref: 00405355

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountExchangeInterlockedTicklstrcpy
String ID:
API String ID: 4162416431-0
Opcode ID: e8acb27dcbe5d2487a86e349a88a12b7971b52c73f8c974b59701084c539f241
Instruction ID: c02146d65d1ec8406dc32d01bb8fb8f303b93c3970f776c7232998cb04b45f4e
Opcode Fuzzy Hash: e8acb27dcbe5d2487a86e349a88a12b7971b52c73f8c974b59701084c539f241
Instruction Fuzzy Hash: 7291AE71A04604AFDF15DF6AC951AAF7BA5EF54304F00447EE816AB382DB78DA40CF98

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 7eca3c6805300db696343a33d9cb0a643204c5b6a4206eeac8d502d0aa8fcc06
Instruction ID: 6b3793665da58c3d641b44977197beb843871c0b6a2cff5b7a0acf506f3bfc8d
Opcode Fuzzy Hash: 7eca3c6805300db696343a33d9cb0a643204c5b6a4206eeac8d502d0aa8fcc06
Instruction Fuzzy Hash: 7741EE718083497EEB269664E88C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 7e4ae6be47200154ff028bb1e1ff25be10201b73ffa926c49eb2fe181a2a4163
Instruction ID: ee48c6aff4f3cfee6008d9a51cd09a6e26e011b11466ee3f62e74e831bc3a826
Opcode Fuzzy Hash: 7e4ae6be47200154ff028bb1e1ff25be10201b73ffa926c49eb2fe181a2a4163
Instruction Fuzzy Hash: 38F0AFB6104218AFD7109B68EDC4FE777BE9714308F1084B6E286E3141DAB89DA85B6C

Function 006F0000 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000008D0,00001000,00000040), ref: 006F0065

Memory Dump Source

Source File: 00000000.00000002.1739541450.00000000006F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_2FnvReiPU6.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4951f6c36d1fa03500621e02ddc7bb0f5560f54398a83bde0800dfd9e4836d3c
Instruction ID: 623b08ccf51c40fcd8a45172b7d15bc7f071fb8975601b203086ba1c7e212142
Opcode Fuzzy Hash: 4951f6c36d1fa03500621e02ddc7bb0f5560f54398a83bde0800dfd9e4836d3c
Instruction Fuzzy Hash: EF01AC759003496BE7102F74CC45BAF3B99FF84720F514469FA9AA7282C97898818B94

Function 007105D0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00710093), ref: 007105DD

Memory Dump Source

Source File: 00000000.00000002.1739553841.0000000000710000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_2FnvReiPU6.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a9a4fa599d775aa83550951cd01ab53a510ae55495336f8eeb8bc52accc60b48
Instruction ID: 65ce390d9ce214b0b9a70d03eb22b0c205847d94ce1a40b3c250883ace489992
Opcode Fuzzy Hash: a9a4fa599d775aa83550951cd01ab53a510ae55495336f8eeb8bc52accc60b48
Instruction Fuzzy Hash: EAB012B22C038477EB304E614C0EF8A3661ABC8FA3F350000FB106B1C48AF0E8018624

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

lid_file_upd, xrefs: 0040CE6A
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
wtm_c, xrefs: 0040C956
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
@, xrefs: 0040D754
4, xrefs: 0040D9F7
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
.sys, xrefs: 0040D0CC
local_time, xrefs: 0040CACD
drivers\, xrefs: 0040D067
\, xrefs: 0040D3A7
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
\, xrefs: 0040D39D
wtm_r, xrefs: 0040C97F
srv_time, xrefs: 0040CABB
wtm_w, xrefs: 0040C96C
flags_upd, xrefs: 0040CE4A

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

uac, xrefs: 00401628
D, xrefs: 004015C6
, xrefs: 00401462
@, xrefs: 00401380
<, xrefs: 00401378
useless, xrefs: 0040161E
PDu, xrefs: 0040139A
%systemroot%\system32\cmd.exe, xrefs: 00401316
wusa.exe, xrefs: 00401388

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

lid_file_upd, xrefs: 00401E25
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
born_date, xrefs: 00401EAD, 00401ECC
loader_id, xrefs: 00401F4B, 00401F6B
net_type, xrefs: 00401E87
work_srv, xrefs: 00401E5E
IsWow64Process, xrefs: 00401DF2
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
start_srv, xrefs: 00401E6C
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
kernel32, xrefs: 00401DF7

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 29b29ba27ec834052d86494178e52c9b6600cd948377f9b0f2b6c99c1419fed0
Instruction ID: 136d33d61de9b77116bbe3bbd7cc91a466c000d0b1383b285604d193ab548d94
Opcode Fuzzy Hash: 29b29ba27ec834052d86494178e52c9b6600cd948377f9b0f2b6c99c1419fed0
Instruction Fuzzy Hash: 1451EAB05043446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040B211 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
API String ID: 766114626-4076198852
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 006F007E Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739541450.00000000006F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_2FnvReiPU6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ea57e9c5b474e0a01886bed018e1aaea45c2fe781a12c9dc45aeed4f903f47
Instruction ID: 5db77fd2341083ad28196d4f9019460ab730360bb2d63ae69d4d10de97621c18
Opcode Fuzzy Hash: b4ea57e9c5b474e0a01886bed018e1aaea45c2fe781a12c9dc45aeed4f903f47
Instruction Fuzzy Hash: D4418172201108AFEB50EF64C945EBAB7AAFF44724F25451DFA059B613CB71EC02CBA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 007103CC Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739553841.0000000000710000.00000040.00001000.00020000.00000000.sdmp, Offset: 00710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_710000_2FnvReiPU6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d612ec0191f637075e5dd3c2021567e28a03859e370f7c7a2e24b6ec4edea73
Instruction ID: 01a5f0ec89f24e968a62e557aac809da5124b40e883a9466b9a22dc6830ed83b
Opcode Fuzzy Hash: 2d612ec0191f637075e5dd3c2021567e28a03859e370f7c7a2e24b6ec4edea73
Instruction Fuzzy Hash: 4EE0E231140040CFCF9A9F28D954694B762FB48329F3488ADE8164A2D2CBBAC8C3CE40

Function 006F03CC Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739541450.00000000006F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_2FnvReiPU6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d612ec0191f637075e5dd3c2021567e28a03859e370f7c7a2e24b6ec4edea73
Instruction ID: 62027f2b813192b09002667c3ccc931cc49f225998ef4390caf2ab2336e49529
Opcode Fuzzy Hash: 2d612ec0191f637075e5dd3c2021567e28a03859e370f7c7a2e24b6ec4edea73
Instruction Fuzzy Hash: C3E0E232140045CFDB9E9F20D9506A4B762FB4832AF3488ADE8064A293CB76C843DE00

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

%d=%p, xrefs: 004066F9
va=%08X%08X uef=%p, xrefs: 00406595
localcfg, xrefs: 0040672D
12:08:32, xrefs: 00406535
plgs:, xrefs: 004066AA
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
Jan 13 2018, xrefs: 0040653A

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: daf4d949a7859ac2eff1297604e09a10f79e0a9bf3e1ba7555a3ae86ccb7c85f
Instruction ID: adaa1854a3122378bd2daea31773aef3e538fc03cb04507581bb4a4c69c5dae0
Opcode Fuzzy Hash: daf4d949a7859ac2eff1297604e09a10f79e0a9bf3e1ba7555a3ae86ccb7c85f
Instruction Fuzzy Hash: F6615E72940208EFDB609FB4DC45FEA77E9FF08300F24846AF96DD21A1DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

., xrefs: 0040A8CA
AUTH LOGIN, xrefs: 0040A80C
localcfg, xrefs: 0040AB0B
ESMTP, xrefs: 0040AA38
data, xrefs: 0040A85E
rcpt to:<%s>, xrefs: 0040A855
Too small respons, xrefs: 0040A9C9
helo %s, xrefs: 0040A803
Incorrect respons, xrefs: 0040AB39
ehlo %s, xrefs: 0040A7F5
Too big smtp respons (%d bytes), xrefs: 0040A9B1
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
mail from:<%s>, xrefs: 0040A848
quit, xrefs: 0040A86C

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,00410750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,00410750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,00410750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,00410750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetIfEntry, xrefs: 004019E4
GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3
123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7
GetBestInterface, xrefs: 004019EF

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040AD89 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(00410750), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%s%d, xrefs: 0040AE58
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_HST, xrefs: 0040AEC5
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX
API String ID: 3631595830-340622817
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

86A, xrefs: 0040BF98
46A, xrefs: 0040BF85
smtp_ban, xrefs: 0040BE55, 0040BF77
06A, xrefs: 0040BF70
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%M5DATE, xrefs: 0040B50F
%TO_EMAIL, xrefs: 0040B473
%FROM_EMAIL, xrefs: 0040B3E9
%TO_USER, xrefs: 0040B488
%TO_HASH, xrefs: 0040B4B0
%DATE, xrefs: 0040B4D2
%TO_DOMAIN, xrefs: 0040B44B
%P5DATE, xrefs: 0040B4F2
%FROM_DOMAIN, xrefs: 0040B41E
%FROM_USER, xrefs: 0040B431
%s@%s, xrefs: 0040B461

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF
rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: a40dfeaab3bfebff7a793825c1972f7e21326da42d84a9a6f547d2f5fe47edea
Instruction ID: a2cdbfba8670e70976da4da8790d1ec110d93932d0bd5f5a37bac27c5c352c9a
Opcode Fuzzy Hash: a40dfeaab3bfebff7a793825c1972f7e21326da42d84a9a6f547d2f5fe47edea
Instruction Fuzzy Hash: C44181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7389A51DBA4

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 0040E654 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE
A, xrefs: 0040E739

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A$ A
API String ID: 3343386518-1846390581
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 0040DDCF Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(?,80000009,00000000,80000001, A,0040DF42,00000000,00000001,?,?,75A8EA50,80000001), ref: 0040DDFF

Strings

A, xrefs: 0040DDD0, 0040DDD5
A, xrefs: 0040DDCF
A, xrefs: 0040DE18

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: c5fbbd52a51a7e9422c94d4498ca6242d6f87b7f53d1a68151d56bafafc3fa70
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 68F06871A00712DBCB20CF55D884993B7E9FF59321B04863BE154D75A0D374A998CB99

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.1739353822.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1739341975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739379619.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739392809.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1739404967.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2FnvReiPU6.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: upwtsplm.exePID: 7836, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1862
Total number of Limit Nodes:	19

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\2FnvReiPU6.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00007530), ref: 0040A4C3

Strings

\, xrefs: 00409D0C
", xrefs: 0040A078
D, xrefs: 00409F8E
", xrefs: 0040A189
", xrefs: 00409EDB
P, xrefs: 00409DAA
C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe, xrefs: 0040A1D9
%X%08X, xrefs: 0040A0B0
C:\Users\user\Desktop\2FnvReiPU6.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
crxslmyv, xrefs: 0040A389, 0040A397

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\2FnvReiPU6.exe$C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe$D$P$\$crxslmyv
API String ID: 2089075347-2208256327
Opcode ID: 2b974e37e574cfed96f5c0f5498e5b8bec196aefc1d7885d2e868791a6bf009d
Instruction ID: 3585989bbaedd28a73b270bd9bf1875f0a43ee57e8055613748a08816c1e76ab
Opcode Fuzzy Hash: 2b974e37e574cfed96f5c0f5498e5b8bec196aefc1d7885d2e868791a6bf009d
Instruction Fuzzy Hash: 585292B1C40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6789E948B69

Function 00D4007E Relevance: 7.6, APIs: 5, Instructions: 131
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D405D0: VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00D40093), ref: 00D405DD

VirtualProtect.KERNELBASE(?,?,00000004,?,?), ref: 00D400C4
VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,00000004,?,?), ref: 00D400D4
VirtualProtect.KERNELBASE(?,?,00000004,?,?,?,?,00000000,?,00000000,?,00000002,?,?,?,00000004), ref: 00D4011D
VirtualProtect.KERNELBASE(00000004,?,?,?,?,00000000,?,00000000,?,00000002,?,?,?,00000004,?,?), ref: 00D40133
VirtualFree.KERNELBASE(?,00004000,00000002,?,?,?,00000004,?,?), ref: 00D40198

Memory Dump Source

Source File: 0000000B.00000002.1736688985.0000000000D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d40000_upwtsplm.jbxd

Similarity

API ID: Virtual$Protect$AllocFree
String ID:
API String ID: 3729553426-0
Opcode ID: b4ea57e9c5b474e0a01886bed018e1aaea45c2fe781a12c9dc45aeed4f903f47
Instruction ID: fdeeef6481958cc95f673701420e8f3bd078903e1f1e34d3bca4e81ef3d23f38
Opcode Fuzzy Hash: b4ea57e9c5b474e0a01886bed018e1aaea45c2fe781a12c9dc45aeed4f903f47
Instruction Fuzzy Hash: 92419272600204AFDB10EF24C885FAABBB9EF44724F254519FA459B612C775EC02CBB0

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
CloseHandle.KERNELBASE(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtSetInformationThread, xrefs: 00401155
NtFilterToken, xrefs: 0040122B
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtOpenProcessToken, xrefs: 004011D4
RtlNtStatusToDosError, xrefs: 00401194
NtTerminateProcess, xrefs: 004010F6
NtClose, xrefs: 004011B4
NtSetInformationToken, xrefs: 00401175
RtlInitUnicodeString, xrefs: 00401135
NtDuplicateToken, xrefs: 004011F3
NtQueryInformationToken, xrefs: 00401262
ntdll.dll, xrefs: 0040100D
RtlSetLastWin32Error, xrefs: 004010D6
RtlFreeSid, xrefs: 00401116
RtlLengthSid, xrefs: 00401246

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: AddressProc$CloseHandleLibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2326521279-3228201535
Opcode ID: 4374d5bc11ca1c2fa60be4766612f3b99720bc46af73de5be8a6125bd1a76152
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 4374d5bc11ca1c2fa60be4766612f3b99720bc46af73de5be8a6125bd1a76152
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(00000000,00000000,004122F8,00000000,0040733D,00000000), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 293dfb801b0d4665576106c5a1887ea473dc781c8fdaf55f1d5b1f1ba08ffc92
Instruction ID: 1fe726b284cde181daef39815de7f37c4bbd18f96b62320efe93ab81be9ef980
Opcode Fuzzy Hash: 293dfb801b0d4665576106c5a1887ea473dc781c8fdaf55f1d5b1f1ba08ffc92
Instruction Fuzzy Hash: FEC1F171D04209ABEB119BA5DC45BEF7BB9EF44310F1004B7F504B71D1EA78AE908B69

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: a40dfeaab3bfebff7a793825c1972f7e21326da42d84a9a6f547d2f5fe47edea
Instruction ID: a2cdbfba8670e70976da4da8790d1ec110d93932d0bd5f5a37bac27c5c352c9a
Opcode Fuzzy Hash: a40dfeaab3bfebff7a793825c1972f7e21326da42d84a9a6f547d2f5fe47edea
Instruction Fuzzy Hash: C44181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7389A51DBA4

Function 00D401D1 Relevance: 4.6, APIs: 3, Instructions: 68
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,?,?,?,00000004,?,?), ref: 00D401F5
VirtualProtect.KERNELBASE(?,?,00000004,?,00000000,?,00000000,?,?,?,00000004,?,?), ref: 00D40212
VirtualProtect.KERNELBASE(?,00000000,?,?,?,00000000,?,?,?,00000004,?,?), ref: 00D4024B

Memory Dump Source

Source File: 0000000B.00000002.1736688985.0000000000D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d40000_upwtsplm.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: df0d4710188bbc4545ffb25a3de640365ec90d346391f8a801651d14009fcf39
Instruction ID: d3a2079c121bb63247e753ecc060fad14fbfbda370a683793f851e63415ba48e
Opcode Fuzzy Hash: df0d4710188bbc4545ffb25a3de640365ec90d346391f8a801651d14009fcf39
Instruction Fuzzy Hash: 8811A3725006206FEB304E19CC88A7BBBACEF85721B19451DFE6AE7140D7B1ED0446B1

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 004050DC Relevance: 4.0, APIs: 3, Instructions: 253
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404BD1: GetTickCount.KERNEL32 ref: 00404BDD
Part of subcall function 00404BD1: InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

lstrcmpA.KERNEL32(-00000010,00000000,?,00000000), ref: 00405114
lstrcpyA.KERNEL32(-00000010,?,?), ref: 00405253
lstrcmpA.KERNEL32(-00000010,00000000,-00000010,?,?,?,?,?), ref: 00405355

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountExchangeInterlockedTicklstrcpy
String ID:
API String ID: 4162416431-0
Opcode ID: e8acb27dcbe5d2487a86e349a88a12b7971b52c73f8c974b59701084c539f241
Instruction ID: c02146d65d1ec8406dc32d01bb8fb8f303b93c3970f776c7232998cb04b45f4e
Opcode Fuzzy Hash: e8acb27dcbe5d2487a86e349a88a12b7971b52c73f8c974b59701084c539f241
Instruction Fuzzy Hash: 7291AE71A04604AFDF15DF6AC951AAF7BA5EF54304F00447EE816AB382DB78DA40CF98

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 7e4ae6be47200154ff028bb1e1ff25be10201b73ffa926c49eb2fe181a2a4163
Instruction ID: ee48c6aff4f3cfee6008d9a51cd09a6e26e011b11466ee3f62e74e831bc3a826
Opcode Fuzzy Hash: 7e4ae6be47200154ff028bb1e1ff25be10201b73ffa926c49eb2fe181a2a4163
Instruction Fuzzy Hash: 38F0AFB6104218AFD7109B68EDC4FE777BE9714308F1084B6E286E3141DAB89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.ADVAPI32(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 00980000 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000008D0,00001000,00000040), ref: 00980065

Memory Dump Source

Source File: 0000000B.00000002.1736660386.0000000000980000.00000040.00001000.00020000.00000000.sdmp, Offset: 00980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_980000_upwtsplm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4951f6c36d1fa03500621e02ddc7bb0f5560f54398a83bde0800dfd9e4836d3c
Instruction ID: b4409f940e19e90500fa42c2a1686b61d032ea1b8c01cf77ba711cf21f49e573
Opcode Fuzzy Hash: 4951f6c36d1fa03500621e02ddc7bb0f5560f54398a83bde0800dfd9e4836d3c
Instruction Fuzzy Hash: E901A7719003456BD7102F74CC45B9F3BA8FFC5721F518869F99AA7381C97CA8808B90

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Function 00D405D0 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00D40093), ref: 00D405DD

Memory Dump Source

Source File: 0000000B.00000002.1736688985.0000000000D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_d40000_upwtsplm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a9a4fa599d775aa83550951cd01ab53a510ae55495336f8eeb8bc52accc60b48
Instruction ID: 65ce390d9ce214b0b9a70d03eb22b0c205847d94ce1a40b3c250883ace489992
Opcode Fuzzy Hash: a9a4fa599d775aa83550951cd01ab53a510ae55495336f8eeb8bc52accc60b48
Instruction Fuzzy Hash: EAB012B22C038477EB304E614C0EF8A3661ABC8FA3F350000FB106B1C48AF0E8018624

Non-executed Functions

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe$D
API String ID: 2976863881-3264072368
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
plgs:, xrefs: 004066AA
va=%08X%08X uef=%p, xrefs: 00406595
Jan 13 2018, xrefs: 0040653A
except_info, xrefs: 00406728
%d=%p, xrefs: 004066F9

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: daf4d949a7859ac2eff1297604e09a10f79e0a9bf3e1ba7555a3ae86ccb7c85f
Instruction ID: adaa1854a3122378bd2daea31773aef3e538fc03cb04507581bb4a4c69c5dae0
Opcode Fuzzy Hash: daf4d949a7859ac2eff1297604e09a10f79e0a9bf3e1ba7555a3ae86ccb7c85f
Instruction Fuzzy Hash: F6615E72940208EFDB609FB4DC45FEA77E9FF08300F24846AF96DD21A1DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

AUTH LOGIN, xrefs: 0040A80C
localcfg, xrefs: 0040AB0B
data, xrefs: 0040A85E
Incorrect respons, xrefs: 0040AB39
mail from:<%s>, xrefs: 0040A848
ehlo %s, xrefs: 0040A7F5
rcpt to:<%s>, xrefs: 0040A855
helo %s, xrefs: 0040A803
Too big smtp respons (%d bytes), xrefs: 0040A9B1
quit, xrefs: 0040A86C
Too small respons, xrefs: 0040A9C9
., xrefs: 0040A8CA
ESMTP, xrefs: 0040AA38
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,00410750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,00410750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,00410750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,00410750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe$localcfg
API String ID: 237177642-1041734748
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

<, xrefs: 00401378
wusa.exe, xrefs: 00401388
uac, xrefs: 00401628
PDu, xrefs: 0040139A
@, xrefs: 00401380
D, xrefs: 004015C6
useless, xrefs: 0040161E
%systemroot%\system32\cmd.exe, xrefs: 00401316
, xrefs: 00401462

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

work_srv, xrefs: 00401E5E
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
lid_file_upd, xrefs: 00401E25
net_type, xrefs: 00401E87
kernel32, xrefs: 00401DF7
IsWow64Process, xrefs: 00401DF2
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
start_srv, xrefs: 00401E6C
born_date, xrefs: 00401EAD, 00401ECC
loader_id, xrefs: 00401F4B, 00401F6B

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 29b29ba27ec834052d86494178e52c9b6600cd948377f9b0f2b6c99c1419fed0
Instruction ID: 136d33d61de9b77116bbe3bbd7cc91a466c000d0b1383b285604d193ab548d94
Opcode Fuzzy Hash: 29b29ba27ec834052d86494178e52c9b6600cd948377f9b0f2b6c99c1419fed0
Instruction Fuzzy Hash: 1451EAB05043446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

Iphlpapi.dll, xrefs: 004019B7
localcfg, xrefs: 004019A3
GetAdaptersInfo, xrefs: 004019DC
GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 330registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(00000000,00000000,004122F8,00000000,0040733D,00000000), ref: 0040F1AD

Strings

", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 2c1a7a5e27a45d9024ae5e8b0fc79a4811596a6e22ca9665a21b83de94bf1e77
Instruction ID: 74598ce6d8ea9c8d39eff0b1fc7e26e3f0ef6396efd0c92e31e65397aa2b09b2
Opcode Fuzzy Hash: 2c1a7a5e27a45d9024ae5e8b0fc79a4811596a6e22ca9665a21b83de94bf1e77
Instruction Fuzzy Hash: 17B17E71C0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501B61D1EB79AA94CB69

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: f08e4a66b1d8eb56d3ad1f8584b36153d56304273cbc9e31910b95c3030bd838
Instruction ID: e1b414ac2acd800f86155b9566517fe94806afef677b15be1bf33dae74c6658f
Opcode Fuzzy Hash: f08e4a66b1d8eb56d3ad1f8584b36153d56304273cbc9e31910b95c3030bd838
Instruction Fuzzy Hash: 33A181B2540208BBEB21DFA1DC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040AD89 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(00410750), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_MID, xrefs: 0040AEAE
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX
API String ID: 3631595830-340622817
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77
06A, xrefs: 0040BF70
86A, xrefs: 0040BF98
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488
%M5DATE, xrefs: 0040B50F
%P5DATE, xrefs: 0040B4F2
%TO_HASH, xrefs: 0040B4B0
%FROM_USER, xrefs: 0040B431
%TO_EMAIL, xrefs: 0040B473
%FROM_DOMAIN, xrefs: 0040B41E
%TO_DOMAIN, xrefs: 0040B44B
%FROM_EMAIL, xrefs: 0040B3E9
%s@%s, xrefs: 0040B461

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 0040B211 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
API String ID: 766114626-4076198852
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: e3959d8a0c931ef24a73e9a1ea7033e807417735a7f73b2997be16ea63ab6e7a
Instruction ID: 1851fce060154b14ea5ec5bf2ccd3ef97631883a8962a6cabbb456f8c1490fb9
Opcode Fuzzy Hash: e3959d8a0c931ef24a73e9a1ea7033e807417735a7f73b2997be16ea63ab6e7a
Instruction Fuzzy Hash: 4731F1B2900208BFDB00DFA09D44ADFBF79EF48310F158076E512F7291D674AA618F69

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 0040E654 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E739

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A$ A
API String ID: 3343386518-1846390581
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe
API String ID: 124786226-1428914613
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 0040DDCF Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(?,80000009,00000000,80000001, A,0040DF42,00000000,00000001,?,?,75A8EA50,80000001), ref: 0040DDFF

Strings

A, xrefs: 0040DE18
A, xrefs: 0040DDCF
A, xrefs: 0040DDD0, 0040DDD5

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: c5fbbd52a51a7e9422c94d4498ca6242d6f87b7f53d1a68151d56bafafc3fa70
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 68F06871A00712DBCB20CF55D884993B7E9FF59321B04863BE154D75A0D374A998CB99

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000B.00000002.1736375134.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1736362009.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736391775.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736406969.0000000000412000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.1736417950.0000000000414000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_upwtsplm.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: svchost.exePID: 7856, Parent PID: 7836COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1807
Total number of Limit Nodes:	18

Executed Functions

Function 0062C913 Relevance: 115.1, APIs: 45, Strings: 20, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0062CA4E
closesocket.WS2_32(?), ref: 0062CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0062CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0062CCB4
WriteFile.KERNEL32(0062A4B3,?,-000000E8,?,00000000), ref: 0062CCDC
CloseHandle.KERNEL32(0062A4B3), ref: 0062CCED
wsprintfA.USER32 ref: 0062CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0062CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0062CD89
CloseHandle.KERNEL32(?), ref: 0062CD98
CloseHandle.KERNEL32(?), ref: 0062CD9D
DeleteFileA.KERNEL32(?), ref: 0062CDC4
CloseHandle.KERNEL32(0062A4B3), ref: 0062CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0062CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0062CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0062D033
lstrcatA.KERNEL32(?,03B00108), ref: 0062D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0062D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0062D171
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000), ref: 0062D195
CloseHandle.KERNEL32(00000000), ref: 0062D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0062D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0062D231
lstrcatA.KERNEL32(?,03B00108,?,?,?,?,?,?,?,00000100), ref: 0062D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0062D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0062D2C7
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0062D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0062D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0062D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0062D372
lstrcatA.KERNEL32(?,03B00108,?,?,?,?,?,?,?,00000100), ref: 0062D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0062D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0062D408
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0062D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0062D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0062D45B
CreateProcessA.KERNEL32(?,00630264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0062D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0062D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0062D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0062D513
closesocket.WS2_32(?), ref: 0062D56C
Sleep.KERNEL32(000003E8), ref: 0062D577
ExitProcess.KERNEL32 ref: 0062D583
wsprintfA.USER32 ref: 0062D81F

Part of subcall function 0062C65C: send.WS2_32(00000000,?,00000000), ref: 0062C74B

closesocket.WS2_32(?), ref: 0062DAD5

Strings

local_time, xrefs: 0062CACD
X c, xrefs: 0062C927, 0062C93C, 0062C9BE
except_info, xrefs: 0062D8CD, 0062D8D2, 0062D8FB
\, xrefs: 0062D3A7
wtm_w, xrefs: 0062C96C
work_srv, xrefs: 0062D607, 0062D60F, 0062D62C
C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe, xrefs: 0062CC10, 0062CCF3, 0062D975, 0062D98E
wtm_r, xrefs: 0062C97F
drivers\, xrefs: 0062D067
localcfg, xrefs: 0062CA89, 0062CA93, 0062CAC0, 0062CAD2, 0062CE4F, 0062CE6F, 0062D8D3, 0062D8FC
.dat, xrefs: 0062D0D7, 0062D138, 0062D1AE, 0062D1D4, 0062D28E, 0062D308, 0062D3CF, 0062D441
.sys, xrefs: 0062D0CC
time_cfg, xrefs: 0062C95B, 0062C962, 0062C971, 0062C984
lid_file_upd, xrefs: 0062CE6A
flags_upd, xrefs: 0062CE4A
srv_time, xrefs: 0062CABB
wtm_c, xrefs: 0062C956
4, xrefs: 0062D9F7
@, xrefs: 0062D754
\, xrefs: 0062D39D

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe$X c$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-1603472655
Opcode ID: b5913138a6148e34724da7226be567d29223e3e4aa0881e3e5dc94a66a7427de
Instruction ID: fd6e39f1c79caffe4c157e1408d7a8b491b99fa620cdb3d3c2c1f8d8bdceaa99
Opcode Fuzzy Hash: b5913138a6148e34724da7226be567d29223e3e4aa0881e3e5dc94a66a7427de
Instruction Fuzzy Hash: 56B2E771900A29AFEB20DFA4ED55EEE7BBFEB05300F140069F645A7291D7709A45CF90

Function 00629A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00629A7F
SetErrorMode.KERNELBASE(00000003), ref: 00629A83
SetUnhandledExceptionFilter.KERNEL32(00626511), ref: 00629A8A

Part of subcall function 0062EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0062EC5E
Part of subcall function 0062EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0062EC72
Part of subcall function 0062EC54: GetTickCount.KERNEL32 ref: 0062EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00629AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00629ABA
GetCommandLineA.KERNEL32 ref: 00629AFD
lstrlenA.KERNEL32(?), ref: 00629B99
ExitProcess.KERNEL32 ref: 00629C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00629CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00629D7A
lstrcatA.KERNEL32(?,?), ref: 00629D8B
lstrcatA.KERNEL32(?,0063070C), ref: 00629D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00629DED
DeleteFileA.KERNEL32(00000022), ref: 00629E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00629E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00629EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00629ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00629F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00629F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00629F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00629FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00629FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00629FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0062A038
lstrcatA.KERNEL32(00000022,00630A34), ref: 0062A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0062A072
lstrcatA.KERNEL32(00000022,00630A34), ref: 0062A08D
wsprintfA.USER32 ref: 0062A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0062A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0062A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0062A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0062A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0062A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0062A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0062A1B6
GetCommandLineA.KERNEL32 ref: 0062A1E5

Part of subcall function 006299D2: lstrcpyA.KERNEL32(?,?,00000100,006322F8,00000000,?,00629E9D,?,00000022,?,?,?,?,?,?,?), ref: 006299DF
Part of subcall function 006299D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00629E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00629A3C
Part of subcall function 006299D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00629E9D,?,00000022,?,?,?), ref: 00629A52

lstrlenA.KERNEL32(?), ref: 0062A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0062A3B7
GetLastError.KERNEL32 ref: 0062A3ED
Sleep.KERNELBASE(000003E8), ref: 0062A400
DeleteFileA.KERNELBASE(006333D8), ref: 0062A407
CreateThread.KERNELBASE(00000000,00000000,0062405E,00000000,00000000,00000000), ref: 0062A42C
WSAStartup.WS2_32(00001010,?), ref: 0062A43A
CreateThread.KERNELBASE(00000000,00000000,0062877E,00000000,00000000,00000000), ref: 0062A469
Sleep.KERNELBASE(00000BB8), ref: 0062A48A
GetTickCount.KERNEL32 ref: 0062A49F
GetTickCount.KERNEL32 ref: 0062A4B7
Sleep.KERNELBASE(00007530), ref: 0062A4C3

Strings

\, xrefs: 00629D0C
D, xrefs: 00629F8E
", xrefs: 0062A078
C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe, xrefs: 0062A1D9
", xrefs: 0062A189
", xrefs: 00629EDB
P, xrefs: 00629DAA
%X%08X, xrefs: 0062A0B0
crxslmyv, xrefs: 0062A389, 0062A397

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe$D$P$\$crxslmyv
API String ID: 2089075347-270588858
Opcode ID: 82b5102548ac7011ff300d4a016fd84d65aefc337f8189b2df2ea0a2cfdbfc81
Instruction ID: 6e1f1d14ab0909bdfaa6c7cd1783885a28077522b5f0d51dc350db3daf24f24c
Opcode Fuzzy Hash: 82b5102548ac7011ff300d4a016fd84d65aefc337f8189b2df2ea0a2cfdbfc81
Instruction Fuzzy Hash: 9D52A6B1D40669AFEF11DFA0EC49EEE77BEAF04300F1444A9F509E2141E7719A488FA5

Function 0062199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 006219B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,00621E9E), ref: 006219BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 006219E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 006219ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 006219F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,00621E9E), ref: 00621A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00621E9E), ref: 00621A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00621E9E), ref: 00621A36
GetAdaptersInfo.IPHLPAPI(00000000,00621E9E,?,?,?,?,00000001,00621E9E), ref: 00621A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,00621E9E,?,?,?,?,00000001,00621E9E), ref: 00621A5A
GetAdaptersInfo.IPHLPAPI(00000000,00621E9E,?,?,?,?,00000001,00621E9E), ref: 00621A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00621E9E), ref: 00621A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00621E9E), ref: 00621AA4

Strings

123.45.67.89, xrefs: 006219A6
GetIfEntry, xrefs: 006219E4
GetAdaptersInfo, xrefs: 006219DC
GetBestInterface, xrefs: 006219EF
Iphlpapi.dll, xrefs: 006219B7
localcfg, xrefs: 006219A3

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: f470aa10103d42d3b391ccee312f5645ec30f2a3c902fa4fcc665de32782afae
Instruction ID: 43b79a1f7f385c46dde9616d97baeffc5bb09027969bc1bfe770499226101397
Opcode Fuzzy Hash: f470aa10103d42d3b391ccee312f5645ec30f2a3c902fa4fcc665de32782afae
Instruction Fuzzy Hash: 7C318B32D05669AFDB119FE4EC988BEBBBBEF66301B24017AE501A6210D7304E45CF90

Function 00627A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00627ABA
GetUserNameA.ADVAPI32(?,?), ref: 00627ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0063070C,?,?,?), ref: 00627B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00627B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00627B59
EqualSid.ADVAPI32(?,00000022), ref: 00627B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00627B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00627B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00627B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 00627BAB
LocalFree.KERNEL32(00000000), ref: 00627BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00627FC9,?,00000000), ref: 00627BCE

Strings

D, xrefs: 00627B0C
C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe, xrefs: 00627CE2, 00627D0F, 00627D23, 00627D24

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe$D
API String ID: 2976863881-3264072368
Opcode ID: d27685810ab5914945b1e660607af6b58dbbd0f88a3b3a52f0ad8c05c6f0a88f
Instruction ID: ef9935f6479647735ac76044c6f9b16ee142aa847567d9522c1eed971bab3670
Opcode Fuzzy Hash: d27685810ab5914945b1e660607af6b58dbbd0f88a3b3a52f0ad8c05c6f0a88f
Instruction Fuzzy Hash: 77A17171A04629AFEF119FA0EC94FEEBBBAFF04701F044469E505E2250D7359A45CFA0

Function 00627809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0062782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00627866
GetLengthSid.ADVAPI32(?), ref: 00627878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0062789A
GetSecurityDescriptorOwner.ADVAPI32(?,00627F63,?), ref: 006278B8
EqualSid.ADVAPI32(?,00627F63), ref: 006278D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 006278E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006278F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00627901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00627910
LocalFree.KERNEL32(00000000), ref: 00627917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00627933
GetAce.ADVAPI32(?,00000000,?), ref: 00627963
EqualSid.ADVAPI32(?,00627F63), ref: 0062798A
DeleteAce.ADVAPI32(?,00000000), ref: 006279A3
EqualSid.ADVAPI32(?,00627F63), ref: 006279C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00627A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00627A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00627A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00627A79
LocalFree.KERNEL32(00000000), ref: 00627A87

Strings

D, xrefs: 0062785C

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 22d9f38afac398de13ab7c1ec52a9ac139d6f834ce6c2293144c4af3b8f9fa28
Instruction ID: a6abbe240c9e523c8634f72640b42d2cab76e09af7d50771f9225161a7d80ca1
Opcode Fuzzy Hash: 22d9f38afac398de13ab7c1ec52a9ac139d6f834ce6c2293144c4af3b8f9fa28
Instruction Fuzzy Hash: D0814E71D04629ABEB21CFA5DD84FEEBBBEEF08340F14416AE505E2250D7349A45CFA0

Function 00628328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,00630750,?,?,00000000,localcfg,00000000), ref: 006283F3
RegQueryValueExA.KERNELBASE(00630750,?,00000000,?,00628893,?,?,?,00000000,00000103,00630750,?,?,00000000,localcfg,00000000), ref: 00628414
RegSetValueExA.KERNELBASE(00630750,?,00000000,00000004,00628893,00000004,?,?,00000000,00000103,00630750,?,?,00000000,localcfg,00000000), ref: 00628441
RegCloseKey.ADVAPI32(00630750,?,?,00000000,00000103,00630750,?,?,00000000,localcfg,00000000), ref: 0062844A

Strings

C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe, xrefs: 006285C8, 006285D5, 006285E5
localcfg, xrefs: 00628348

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe$localcfg
API String ID: 237177642-1041734748
Opcode ID: 99c40c53c76f0b8e975ee4e0285f1ba36c55365a2416a4caeba4c28b043dc6ac
Instruction ID: 223ff98ccd4ae8ae88c573366cfeb00f8de6da7aef89ad3493a561fb38572e91
Opcode Fuzzy Hash: 99c40c53c76f0b8e975ee4e0285f1ba36c55365a2416a4caeba4c28b043dc6ac
Instruction Fuzzy Hash: 10C1C2B194162ABFEF51AFA4EC95EEE7BBEEB04300F144069F601A3151EB314E448F65

Function 00621D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 00621DC6
GetSystemInfo.KERNELBASE(?), ref: 00621DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00621E03
GetProcAddress.KERNEL32(00000000), ref: 00621E0A
GetCurrentProcess.KERNEL32(?), ref: 00621E1B
GetTickCount.KERNEL32 ref: 00621FC9

Part of subcall function 00621BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00621C15

Strings

hi_id, xrefs: 00621F16, 00621F1B, 00621F33
net_type, xrefs: 00621E87
kernel32, xrefs: 00621DF7
lid_file_upd, xrefs: 00621E25
flags_upd, xrefs: 00621E3E, 00621E43, 00621E7C
work_srv, xrefs: 00621E5E
IsWow64Process, xrefs: 00621DF2
start_srv, xrefs: 00621E6C
loader_id, xrefs: 00621F4B, 00621F6B
localcfg, xrefs: 00621E2A, 00621E31, 00621E44, 00621E7D, 00621E8C, 00621EB2, 00621ED1, 00621EE7, 00621EFF, 00621F1C, 00621F34, 00621F50, 00621F70
born_date, xrefs: 00621EAD, 00621ECC

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: b3aabe6584f9b344ec5bd4e40e00abda11370afa26c2f81361e6a5e7c505783a
Instruction ID: 1167818ed7484e1261e5971620d9eeb520726b761bec992b622dc8f4348955cc
Opcode Fuzzy Hash: b3aabe6584f9b344ec5bd4e40e00abda11370afa26c2f81361e6a5e7c505783a
Instruction Fuzzy Hash: FE5126B0904B546FF370AF759C86F67BAEEEF55704F00082CF4968A242D775A9088BA5

Function 006273FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00627472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 006274F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00627528
___ascii_stricmp.LIBCMT ref: 0062764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 006276E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00627706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00627717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00627745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 006277EF

Part of subcall function 0062F1A5: lstrlenA.KERNEL32(00000000,00000000,006322F8,00000000,0062733D,00000000), ref: 0062F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0062778F
RegCloseKey.KERNELBASE(?), ref: 006277E6

Strings

", xrefs: 00627599

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 119ed9b20355eb80c789d4cf35e9f0cd762610cd5b98d2f7ed0bd14b57456f8c
Instruction ID: cd04fd2dd398d2ddd1a467487a85b7ba779a0c6a2c22dbff81b3106d7eed4e47
Opcode Fuzzy Hash: 119ed9b20355eb80c789d4cf35e9f0cd762610cd5b98d2f7ed0bd14b57456f8c
Instruction Fuzzy Hash: 13C1A271904A29AFEB119FA4EC45FEEBBBAEF45310F1400A5F504E6291EB31DE448F64

Function 0062675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0062677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0062679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 006267B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 006267BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 006267D3
ReadFile.KERNELBASE(000000FF,?,00000040,00628244,00000000,?,74DF0F10,00000000), ref: 00626807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0062681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0062683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0062685C
ReadFile.KERNEL32(000000FF,?,00000028,00628244,00000000,?,74DF0F10,00000000), ref: 0062688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00626906
ReadFile.KERNEL32(000000FF,?,00000000,00628244,00000000,?,74DF0F10,00000000), ref: 0062691C
CloseHandle.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 00626971

Part of subcall function 0062EC2E: GetProcessHeap.KERNEL32(00000000,'b,00000000,0062EA27,00000000), ref: 0062EC41
Part of subcall function 0062EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0062EC48

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: 51ac4c6a5de9f510c5af45005994dff7fa2177c3a6246cf5b5636fbcdcb8682d
Instruction ID: 50a509c7062a13b649246bbd7718dc0e86ab75fe9e719e333cbfc3fb513ce2b7
Opcode Fuzzy Hash: 51ac4c6a5de9f510c5af45005994dff7fa2177c3a6246cf5b5636fbcdcb8682d
Instruction Fuzzy Hash: EF710B71D0062AEFDF118FA4DC809EEBBBAFB04314F10456AF515A6290D7309E96DFA0

Function 0062F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(0062CA1D), ref: 0062F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0062F367
closesocket.WS2_32(00000000), ref: 0062F375

Strings

time_cfg, xrefs: 0062F323

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 630760c50835386ca446f548bd47f0bc3ce3e118f76fa39a10bc960969e2edb3
Instruction ID: f5c6622d6389a9e93421687974b25e5631b56df45f135188fd60f08d187acc97
Opcode Fuzzy Hash: 630760c50835386ca446f548bd47f0bc3ce3e118f76fa39a10bc960969e2edb3
Instruction Fuzzy Hash: ED317872900528ABEB10DFA4EC899EF7BFEEB88314F104176F905E2151E6708A458FE0

Function 0062405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00624070
ExitProcess.KERNEL32 ref: 00624121

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: f03ba6cd0bd54411062a4e6877fb9fa20dac3c96f1a27b13f7a80307212935b6
Instruction ID: 5c1161362df03bb98eb633e1f5988cf9de8c321f42b6f62587ba54e711d7f75d
Opcode Fuzzy Hash: f03ba6cd0bd54411062a4e6877fb9fa20dac3c96f1a27b13f7a80307212935b6
Instruction Fuzzy Hash: 7F51A5B1D00629BBEB109BA1AD85FFF7B7EEF11754F100065F600A6280DB358A45CFA1

Function 00622D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00622F01,?,006220FF,00632000), ref: 00622D3A
LoadLibraryA.KERNEL32(?), ref: 00622D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00622D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 00622D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00622D99
HeapAlloc.KERNEL32(00000000), ref: 00622DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00622DCB

Strings

dnsapi.dll, xrefs: 00622D29
DnsQuery_A, xrefs: 00622D5B

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: f6052097e7c8dbe031423185d4a18fa963a9481cfaa1fcb327056756db0b3e25
Instruction ID: 3ae69897cb8464b86ef68755127bc54b5f9c3ff0b81ff887942e19b7259fe634
Opcode Fuzzy Hash: f6052097e7c8dbe031423185d4a18fa963a9481cfaa1fcb327056756db0b3e25
Instruction Fuzzy Hash: 86216271900A26BBDB119F94EC64AEEBBBAEF08750F104451F905E7210D770A9858BD0

Function 006280C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0062815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0062A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00628187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0062A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 006281BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00628210

Part of subcall function 0062675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0062677E
Part of subcall function 0062675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0062679A
Part of subcall function 0062675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 006267B0
Part of subcall function 0062675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 006267BF
Part of subcall function 0062675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 006267D3
Part of subcall function 0062675C: ReadFile.KERNELBASE(000000FF,?,00000040,00628244,00000000,?,74DF0F10,00000000), ref: 00626807
Part of subcall function 0062675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0062681F
Part of subcall function 0062675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0062683E
Part of subcall function 0062675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0062685C

Part of subcall function 0062EC2E: GetProcessHeap.KERNEL32(00000000,'b,00000000,0062EA27,00000000), ref: 0062EC41
Part of subcall function 0062EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0062EC48

Strings

C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe, xrefs: 00628225, 0062823A

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe
API String ID: 124786226-1428914613
Opcode ID: 1dd2c25c9b5c390a69bc91a8220444bb325157ceee2f7973e6ebb3fd50d3cebb
Instruction ID: a7f5fd0a5c212d64254a9bd802aaafceeeffff97e258449900af018aee493659
Opcode Fuzzy Hash: 1dd2c25c9b5c390a69bc91a8220444bb325157ceee2f7973e6ebb3fd50d3cebb
Instruction Fuzzy Hash: 3C41B4B190252ABFEB50EBA0FD95DFE776EEB10300F04146AF501A3151EA715F488F94

Function 00621AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00621AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00621AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00621B20

Strings

GetAdaptersAddresses, xrefs: 00621AE3
Iphlpapi.dll, xrefs: 00621ACC

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: efe23e13039cfe04bc3ca6d70a6b60b83a6df4c455b75954b8f82db785313b26
Instruction ID: ae26fbb45e6ea8e8cbdb0a67b28e51e619f7512382b7e198a8ec9d995ff071fe
Opcode Fuzzy Hash: efe23e13039cfe04bc3ca6d70a6b60b83a6df4c455b75954b8f82db785313b26
Instruction Fuzzy Hash: 4F110671E05538BFCB259BA4EC848EEBBBBEB6AB12F144055E005AB200E6304E40CF84

Function 0062E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,0062E5F2,00000000,00020119,0062E5F2,006322F8), ref: 0062E3E6
RegQueryValueExA.ADVAPI32(0062E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0062E44E
RegQueryValueExA.ADVAPI32(0062E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0062E482
RegQueryValueExA.ADVAPI32(0062E5F2,?,00000000,?,80000001,?), ref: 0062E4CF
RegCloseKey.ADVAPI32(0062E5F2,?,?,?,?,000000C8,000000E4), ref: 0062E520

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 8842f654a027d6aa7da8f611f6b93879f6c04daf5bdcb7c83d0230cdbcb0e37b
Instruction ID: fd8904c3357cb63650425b226b62429fd9950fc446d4dede2903ed5562620dba
Opcode Fuzzy Hash: 8842f654a027d6aa7da8f611f6b93879f6c04daf5bdcb7c83d0230cdbcb0e37b
Instruction Fuzzy Hash: 0941F8B2D00529AFEF119FD4EC85DEEBBBAEB04304F544465E911B6250E3329A558FA0

Function 0062F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0062F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0062F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0062F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0062F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0062F2FD

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: cca4a02780e60c776cce4624abc6c4762bd0ddef50c1252d7d66939ed62854d6
Instruction ID: dedf1928b006653050ee6d26b5019d165d71f0802938eb589942dd40047de63e
Opcode Fuzzy Hash: cca4a02780e60c776cce4624abc6c4762bd0ddef50c1252d7d66939ed62854d6
Instruction Fuzzy Hash: 47110AB2A40248BAEF11DF94CD85FDE7FBDEB44751F008066BB04EA1D0E6B19A44CB94

Function 00621BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00621AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00621AD4
Part of subcall function 00621AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00621AE9
Part of subcall function 00621AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00621B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00621C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00621C51

Strings

hi_id, xrefs: 00621BE5
localcfg, xrefs: 00621BE7

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 97c11b680c7c4521321958d1702643cfa360cea07c0fa28cb11ab9b27942f4f1
Instruction ID: cb03b767518131abd6849c5fcd78172e6703181d6fd376d5252bae7d6b10d346
Opcode Fuzzy Hash: 97c11b680c7c4521321958d1702643cfa360cea07c0fa28cb11ab9b27942f4f1
Instruction Fuzzy Hash: D901D676A44528BFEB10DAF8DCC09EFBBBDE715344F100475E602E7100D2348D448AA0

Function 00621B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00621AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00621AD4
Part of subcall function 00621AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00621AE9
Part of subcall function 00621AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00621B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00621BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,00621EFD,00000000,00000000,00000000,00000000), ref: 00621BB8

Strings

localcfg, xrefs: 00621B7B

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: acdbdee0d458334047082570e388a4566dfb428a22cd7536cc879a04e3285449
Instruction ID: 4168bf36a3e8fe69007c280451b509bf5a49aae412b83452e4a13039caef6f2f
Opcode Fuzzy Hash: acdbdee0d458334047082570e388a4566dfb428a22cd7536cc879a04e3285449
Instruction Fuzzy Hash: E2018BB2D04518BFEB009BE9DC819EFFABEAB58650F150062A601E7140D6705E084AE0

Function 00622684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00622693
gethostbyname.WS2_32(00000001), ref: 0062269F

Strings

time_cfg, xrefs: 00622684

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 5a530b5871fef9f38d49e1007efbcba268d14f8cd63942632e0f35d20a062ab9
Instruction ID: 9688b2f151f1b8608884ec636d3706d536efb64bd25b8ca737818a42b1e05c0b
Opcode Fuzzy Hash: 5a530b5871fef9f38d49e1007efbcba268d14f8cd63942632e0f35d20a062ab9
Instruction Fuzzy Hash: ADE0C231204822AFDB108B28F868AC637E6EF06330F018180F440D32A0C730DC808B80

Function 0062EC2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0062EBA0: GetProcessHeap.KERNEL32(00000000,00000000,0062EC0A,00000000,80000001,?,0062DB55,7FFF0001), ref: 0062EBAD
Part of subcall function 0062EBA0: HeapSize.KERNEL32(00000000,?,0062DB55,7FFF0001), ref: 0062EBB4

GetProcessHeap.KERNEL32(00000000,'b,00000000,0062EA27,00000000), ref: 0062EC41
RtlFreeHeap.NTDLL(00000000), ref: 0062EC48

Strings

'b, xrefs: 0062EC2F, 0062EC37, 0062EC3E

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID: 'b
API String ID: 1305341483-118111435
Opcode ID: 7d549be9fc4259f531326d5ab177737651b8d075d33844b15be97c1f9c191fdc
Instruction ID: be34adbb9e9942862ff76d2076dc73471fded70d77aefcd99d7afe57c767dd9e
Opcode Fuzzy Hash: 7d549be9fc4259f531326d5ab177737651b8d075d33844b15be97c1f9c191fdc
Instruction Fuzzy Hash: EFC012325066306BD6512790BD1DFDB6B1ADF45712F090409F40566250876058404AE5

Function 0062E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0062DD05: GetTickCount.KERNEL32 ref: 0062DD0F
Part of subcall function 0062DD05: InterlockedExchange.KERNEL32(006336B4,00000001), ref: 0062DD44
Part of subcall function 0062DD05: GetCurrentThreadId.KERNEL32 ref: 0062DD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,0062A445), ref: 0062E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,74DF0F10,?,00000000,?,0062A445), ref: 0062E583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,0062A445), ref: 0062E5B2

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: f93781cbe27c8b252af0887b8ab5483448431b230bd39c76c8ace0314e28adfc
Instruction ID: 0db8b884007eebd005ebf1a8f292d526c5f343b08ee944331cdafa3131bbdee2
Opcode Fuzzy Hash: f93781cbe27c8b252af0887b8ab5483448431b230bd39c76c8ace0314e28adfc
Instruction Fuzzy Hash: 612105B2A406213AE6647B21BC17FAB3A0FDF51750F00042CFA0AB52D3EA52D910CAF5

Function 0062877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 006288A5

Part of subcall function 0062F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0062E342,00000000,75A8EA50,80000001,00000000,0062E513,?,00000000,00000000,?,000000E4), ref: 0062F089
Part of subcall function 0062F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0062E342,00000000,75A8EA50,80000001,00000000,0062E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0062F093

Strings

rresolv, xrefs: 006287F6, 0062885C
localcfg, xrefs: 006287CA, 006287CF, 006287FB, 00628835, 00628861

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 14193fcac3cdf82ec89c05061a315df6b24cf8771e0fa3ae395e2d6e4e0af7c3
Instruction ID: 83991c1f0ba16e0f8e41f40bb9b68c839382fc45b53649d5ff0fddf1fff49b50
Opcode Fuzzy Hash: 14193fcac3cdf82ec89c05061a315df6b24cf8771e0fa3ae395e2d6e4e0af7c3
Instruction Fuzzy Hash: 38210971189B226EF354B7657C63FAA3AEBDB00710F90002DF504961C3EE9955844DFA

Function 00624000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,006322F8,006242B6,00000000,00000001,006322F8,00000000,?,006298FD), ref: 00624021
GetLastError.KERNEL32(?,006298FD,00000001,00000100,006322F8,0062A3C7), ref: 0062402C
Sleep.KERNEL32(000001F4,?,006298FD,00000001,00000100,006322F8,0062A3C7), ref: 00624046

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 136ecc17d963e3bfa619a7ac4cddc44a52bf5661c6ffaa7d17b451d03b7bed18
Instruction ID: e024d781974abee58d02defa61bfd4fbcf35c167f3c7213dca92ad0392d3c3a3
Opcode Fuzzy Hash: 136ecc17d963e3bfa619a7ac4cddc44a52bf5661c6ffaa7d17b451d03b7bed18
Instruction Fuzzy Hash: C6F0A7316405116BE7354B28BC49B5A3263FB81720F254B24F3B5E61E0CB3058C5DF54

Function 0062DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0062DC19,?,00000104), ref: 0062DB7F
lstrcpyA.KERNEL32(?,006328F8), ref: 0062DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 0062DBC2

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: 865fa356beab63fcf0e9ab154127a8b75af6befbd556d0ad1412dc6ee19632f2
Instruction ID: a115acbbb89a27753a96891e379684e8ebb229b067de610cc97a531ec55490f6
Opcode Fuzzy Hash: 865fa356beab63fcf0e9ab154127a8b75af6befbd556d0ad1412dc6ee19632f2
Instruction Fuzzy Hash: D1F0B4B0100609ABEF10DF64EC59FD93B6ABB14308F204194FB51A40D0D7F2D549CF54

Function 0062EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0062EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0062EC72
GetTickCount.KERNEL32 ref: 0062EC78

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 30cb74b25070ef25c50a9c79f6cdf4b7aff3bdc978eed975aee5f34394320f84
Instruction ID: bcc46add32e766b3e898cbc519a3f30ec91c1cc70b8a54f24797fbc61fec5ed0
Opcode Fuzzy Hash: 30cb74b25070ef25c50a9c79f6cdf4b7aff3bdc978eed975aee5f34394320f84
Instruction Fuzzy Hash: E7E0BFF5810104BFEB05EBB0DD5EE7B77BDFB08314F501650B911D61A0DA709A088BA0

Function 006230B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 006230D8
gethostbyname.WS2_32(?), ref: 006230E2

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 83b43cc0d789ac238a70407081c7856cce5a54ae24fad3a5273df21b0f2db49f
Instruction ID: 4b6eb30f3e1c254a4d002e96b2fba697c94f0bb78edae6891d2b9ced422b7b63
Opcode Fuzzy Hash: 83b43cc0d789ac238a70407081c7856cce5a54ae24fad3a5273df21b0f2db49f
Instruction Fuzzy Hash: E9E09B71900129ABDF00DBA8EC89FCB77ECFF04304F080061F945E3250EA34E5088BA4

Function 0062EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0062EBFE,7FFF0001,?,0062DB55,7FFF0001), ref: 0062EBD3
RtlAllocateHeap.NTDLL(00000000,?,0062DB55,7FFF0001), ref: 0062EBDA

Part of subcall function 0062EB74: GetProcessHeap.KERNEL32(00000000,00000000,0062EC28,00000000,?,0062DB55,7FFF0001), ref: 0062EB81
Part of subcall function 0062EB74: HeapSize.KERNEL32(00000000,?,0062DB55,7FFF0001), ref: 0062EB88

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: 38d65036fc68769719b5a9f0f7284a89f798808022e6d8a9d5431e09047aeac8
Instruction ID: 281296008b14a77e28a76f2c921af231a285a0587311b7c898e07c5affe9408e
Opcode Fuzzy Hash: 38d65036fc68769719b5a9f0f7284a89f798808022e6d8a9d5431e09047aeac8
Instruction Fuzzy Hash: 67C08C336082306BE74127E4BC0CE9A3E9AEF083A3F040018F609C6260CB3048408BE6

Function 0062F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,0062CA44), ref: 0062F476

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 299be994ad230480c7cbd445994092e64029d8b7de3eefdf88da3b661714c6f0
Instruction ID: 5a65748f1e7c78e55ac3da021a06885ac90b866fae9087417489909638a4b521
Opcode Fuzzy Hash: 299be994ad230480c7cbd445994092e64029d8b7de3eefdf88da3b661714c6f0
Instruction Fuzzy Hash: D3F01272201559AB9B11AF59EC84CEB3BAEFB893507040131FA14D7111D671D9258BA0

Function 00621978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 00621992

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: ac3834596a69f813cab6dbcf193741f8ddec3cf1b217e6e1246a67ad1969ce83
Instruction ID: 3b8a78b641c061d498b786680138aa49fafa807fc5942b70f6fed1a6938847ad
Opcode Fuzzy Hash: ac3834596a69f813cab6dbcf193741f8ddec3cf1b217e6e1246a67ad1969ce83
Instruction Fuzzy Hash: D0D02232108A313A52003318BC148BFABDDCF05262700803AFC48C0110C630CC8187D5

Function 0062DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 0062DDB5

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 77cb1902c4c3943bcca0848449ef685df251ffb5e787438cf12d73e6e14d9d50
Instruction ID: d55c22ac2bf411045f3b42c0467fd0110e8e51ad1285582768c9b78fff79e347
Opcode Fuzzy Hash: 77cb1902c4c3943bcca0848449ef685df251ffb5e787438cf12d73e6e14d9d50
Instruction Fuzzy Hash: FBF08C35200E63CBCB24CE24A884696B7EAEF85325F244C3EE155D2290D730DC49CF51

Non-executed Functions

Function 0062637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00629816,EntryPoint), ref: 0062638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00629816,EntryPoint), ref: 006263A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 006263CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 006263EB

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: a2303d6d873ad0319893424d85f24fdd4a4090c74dd0a5a73aab40a9714ffe63
Instruction ID: dcc409c07790f63cd5fa6134c559484692f654c92bc4665e23be23cea4344b6f
Opcode Fuzzy Hash: a2303d6d873ad0319893424d85f24fdd4a4090c74dd0a5a73aab40a9714ffe63
Instruction Fuzzy Hash: 8F1173B2600629BFEB259F65EC49F9B3BA9EB047A5F114024F905E7290D671DD008FA4

Function 00621000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00621839,00629646), ref: 00621012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 006210C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 006210E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00621101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00621121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00621140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00621160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00621180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0062119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 006211BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 006211DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 006211FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0062121A

Strings

NtFilterToken, xrefs: 0062122B
NtTerminateProcess, xrefs: 006210F6
ntdll.dll, xrefs: 0062100D
RtlAllocateAndInitializeSid, xrefs: 0062120F
NtDuplicateToken, xrefs: 006211F3
NtQueryInformationToken, xrefs: 00621262
NtClose, xrefs: 006211B4
NtOpenProcessToken, xrefs: 006211D4
RtlNtStatusToDosError, xrefs: 00621194
NtSetInformationThread, xrefs: 00621155
RtlSetLastWin32Error, xrefs: 006210D6
RtlFreeSid, xrefs: 00621116
RtlLengthSid, xrefs: 00621246
NtSetInformationToken, xrefs: 00621175
RtlExpandEnvironmentStrings_U, xrefs: 006210BC
RtlInitUnicodeString, xrefs: 00621135

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: f80b82e630f04ef7ae6a830539c2598f8c63444316406b4bdf32f0e8ace759dd
Instruction ID: 409ef67261651b8e4e810e733882162bda0e98feb9eb9c5321b41d41846586d2
Opcode Fuzzy Hash: f80b82e630f04ef7ae6a830539c2598f8c63444316406b4bdf32f0e8ace759dd
Instruction Fuzzy Hash: 0851507154AA31E6D7208B68BC4079636EB675A321F151356A420DA3F0EBF4CBC2CFD1

Function 0062B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0062B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0062B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0062B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0062B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0062B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0062B329
wsprintfA.USER32 ref: 0062B3B7

Strings

Mar, xrefs: 0062B264
Oct, xrefs: 0062B295
Aug, xrefs: 0062B287
Sat, xrefs: 0062B24F
Mon, xrefs: 0062B22C
Tue, xrefs: 0062B233
Sep, xrefs: 0062B28E
May, xrefs: 0062B272
Apr, xrefs: 0062B26B
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0062B3AF
Dec, xrefs: 0062B2A3
Jan, xrefs: 0062B256
Jul, xrefs: 0062B280
Thu, xrefs: 0062B241
Nov, xrefs: 0062B29C
Jun, xrefs: 0062B279
Sun, xrefs: 0062B225
Fri, xrefs: 0062B248
Wed, xrefs: 0062B23A
Feb, xrefs: 0062B25D

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 0953581f4ad677ddddf43a8375548b9077df21f40b817ae88703bd3dcce9f807
Instruction ID: a92f14d0c178bcd9c507f5a21e3b7ce214d21d42b967f7cfc89ba4432f0880b7
Opcode Fuzzy Hash: 0953581f4ad677ddddf43a8375548b9077df21f40b817ae88703bd3dcce9f807
Instruction Fuzzy Hash: 17511AB1D0022DABEF14DFD5D8958EEBBBAFF48304F146129E601A6150D3B44A8DCBD4

Function 00626511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0062654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0062655C
htonl.WS2_32(?), ref: 00626578
htonl.WS2_32(?), ref: 00626587
wsprintfA.USER32 ref: 0062659B
wsprintfA.USER32 ref: 006265DC
wsprintfA.USER32 ref: 00626671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0062668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00626696
wsprintfA.USER32 ref: 006266B0
wsprintfA.USER32 ref: 006266E7
wsprintfA.USER32 ref: 006266FF
wsprintfA.USER32 ref: 0062671F
ExitProcess.KERNEL32 ref: 00626755

Strings

%d=%p, xrefs: 006266F9
except_info, xrefs: 00626728
12:08:32, xrefs: 00626535
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 006265D6
ver=%d date=%s %sc=%08x a=%p, xrefs: 00626547
plgs:, xrefs: 006266AA
va=%08X%08X uef=%p, xrefs: 00626595
localcfg, xrefs: 0062672D
Jan 13 2018, xrefs: 0062653A
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0062666B

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 2f80c6cf80cfab34b7180d39133f471961f095b9bc7541a23a98b81e4ec1be2b
Instruction ID: 5b5b4b824dd60a2d732d0e69b09dcb8961c178b16fb7f0feb4b6f091afc0bded
Opcode Fuzzy Hash: 2f80c6cf80cfab34b7180d39133f471961f095b9bc7541a23a98b81e4ec1be2b
Instruction Fuzzy Hash: 47616D72940618AFEB609FB4EC45FEA77FAFF08300F144069F968D2261EA719944CF60

Function 0062A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0062A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0062A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0062A893
wsprintfA.USER32 ref: 0062A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0062A8D2
wsprintfA.USER32 ref: 0062A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0062A97C
wsprintfA.USER32 ref: 0062A9B9

Strings

Incorrect respons, xrefs: 0062AB39
Error sending command (sent = %d/%d), xrefs: 0062A8A7, 0062A8DA
Too small respons, xrefs: 0062A9C9
rcpt to:<%s>, xrefs: 0062A855
quit, xrefs: 0062A86C
ESMTP, xrefs: 0062AA38
helo %s, xrefs: 0062A803
localcfg, xrefs: 0062AB0B
data, xrefs: 0062A85E
Too big smtp respons (%d bytes), xrefs: 0062A9B1
mail from:<%s>, xrefs: 0062A848
AUTH LOGIN, xrefs: 0062A80C
., xrefs: 0062A8CA
ehlo %s, xrefs: 0062A7F5

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 0fafc4a8c61080645eccd34fa70e98e50ed95e7b3d8c880a2524f0256370cbd3
Instruction ID: b5b601849e25270905fe3931febed8500e11273d321611edacc6d90d84c11f85
Opcode Fuzzy Hash: 0fafc4a8c61080645eccd34fa70e98e50ed95e7b3d8c880a2524f0256370cbd3
Instruction Fuzzy Hash: 8CA13A71904B35ABEF208AD4FC95FEE776BAB01304F240026F941A6291D6B18D89CF97

Function 00621280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0062139A
lstrlenW.KERNEL32(-00000003), ref: 00621571

Strings

D, xrefs: 006215C6
PDu, xrefs: 0062139A
uac, xrefs: 00621628
@, xrefs: 00621380
useless, xrefs: 0062161E
%systemroot%\system32\cmd.exe, xrefs: 00621316
wusa.exe, xrefs: 00621388
, xrefs: 00621462
<, xrefs: 00621378

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 8f3753b929661c8856aa2269f4cccbfe19be3de25c0b34e38a82f79dd4a424aa
Instruction ID: 8fcfb4ff85ddaefd17b11cd0d1fa7a1a825a3c2a7dbe586dc77c57cbb4524345
Opcode Fuzzy Hash: 8f3753b929661c8856aa2269f4cccbfe19be3de25c0b34e38a82f79dd4a424aa
Instruction Fuzzy Hash: 01F199B1508761DFD320CF64D888BAAB7E6FB9A300F10492DF5969B390D7749944CF92

Function 00622A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00622A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00622A86
socket.WS2_32(00000002,00000002,00000011), ref: 00622AA0
htons.WS2_32(00000000), ref: 00622ADB
select.WS2_32 ref: 00622B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00622B4A
htons.WS2_32(?), ref: 00622B71
htons.WS2_32(?), ref: 00622B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00622BFB

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 8a34af8bb21f680b7027f48cde6b655a4f221e81fc4c0ea8273a22a2880dc5ac
Instruction ID: 17a243d0b18a90d6b8b1e9a321140ef48da6e5019f1523083bc77665191cc83a
Opcode Fuzzy Hash: 8a34af8bb21f680b7027f48cde6b655a4f221e81fc4c0ea8273a22a2880dc5ac
Instruction Fuzzy Hash: 3961F471A04726AFD7609F60EC18B6FBBEAFB48745F014809F9459B250D7B0D8448FA2

Function 0062704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 330registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 006270C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0062719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 006271B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00627208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00627291
___ascii_stricmp.LIBCMT ref: 006272C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 006272D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00627314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0062738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 006273D8

Part of subcall function 0062F1A5: lstrlenA.KERNEL32(00000000,00000000,006322F8,00000000,0062733D,00000000), ref: 0062F1AD

Strings

", xrefs: 00627227
, xrefs: 00627194

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 3f8d4d07299cf736dbf84e9e2c88a8ebc120f90bf3b3b720b3e1b3df2b0e0901
Instruction ID: db4fc598e4665e3fa7d8511b71cd68250c06701502cc7ed53d257a89042400c5
Opcode Fuzzy Hash: 3f8d4d07299cf736dbf84e9e2c88a8ebc120f90bf3b3b720b3e1b3df2b0e0901
Instruction Fuzzy Hash: 9AB1737290462AEEEF15DFA0EC45FEE77BAAF04300F100469F501E6190EB719A94CF65

Function 0062AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0062AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0062ADA6

Part of subcall function 0062AD08: gethostname.WS2_32(?,00000080), ref: 0062AD1C
Part of subcall function 0062AD08: lstrlenA.KERNEL32(00000000), ref: 0062AD60
Part of subcall function 0062AD08: lstrlenA.KERNEL32(00000000), ref: 0062AD69
Part of subcall function 0062AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0062AD7F

Part of subcall function 006230B5: gethostname.WS2_32(?,00000080), ref: 006230D8
Part of subcall function 006230B5: gethostbyname.WS2_32(?), ref: 006230E2

wsprintfA.USER32 ref: 0062AEA5

Part of subcall function 0062A7A3: inet_ntoa.WS2_32(?), ref: 0062A7A9

wsprintfA.USER32 ref: 0062AE4F
wsprintfA.USER32 ref: 0062AE5E

Part of subcall function 0062EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0062EF92
Part of subcall function 0062EF7C: lstrlenA.KERNEL32(?), ref: 0062EF99
Part of subcall function 0062EF7C: lstrlenA.KERNEL32(00000000), ref: 0062EFA0

Strings

%OUTLOOK_BND_, xrefs: 0062AE0F, 0062AE14, 0062AE57, 0062AE76
%OUTLOOK_MID, xrefs: 0062AEAE
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0062AE9F
127.0.0.1, xrefs: 0062ADEB
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0062AE49
%OUTLOOK_HST, xrefs: 0062AEC5
%s%d, xrefs: 0062AE58

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 2ae4167b3d326163288bdc186463c90bd0f7fd3bfb70c6b9eb51fe2b4e60bb05
Instruction ID: d677b2a7868c89216841974db6917b1405e19b94e083ec74c3aa1b2419a726a7
Opcode Fuzzy Hash: 2ae4167b3d326163288bdc186463c90bd0f7fd3bfb70c6b9eb51fe2b4e60bb05
Instruction Fuzzy Hash: D14132B290061CABEF25EFA0DC46EEE7BAEFF08300F14442AF91592152E671D958CF55

Function 00622DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00622F0F,?,006220FF,00632000), ref: 00622E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00622F0F,?,006220FF,00632000), ref: 00622E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00622E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00622F0F,?,006220FF,00632000), ref: 00622E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00622F0F,?,006220FF,00632000), ref: 00622E4F
htons.WS2_32(00000035), ref: 00622E88
inet_addr.WS2_32(?), ref: 00622E93
gethostbyname.WS2_32(?), ref: 00622EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00622F0F,?,006220FF,00632000), ref: 00622EE3
HeapFree.KERNEL32(00000000,?,00000000,00622F0F,?,006220FF,00632000), ref: 00622EE6

Strings

iphlpapi.dll, xrefs: 00622DFB, 00622E00, 00622E10
GetNetworkParams, xrefs: 00622E28

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 0cfce7c553b29f4568a6b2b55e81417803173907460d985a3f10244bf980096b
Instruction ID: 5d559c00577ef64884e5056b0517be979685e842561abe2a8372caf171b14c3b
Opcode Fuzzy Hash: 0cfce7c553b29f4568a6b2b55e81417803173907460d985a3f10244bf980096b
Instruction Fuzzy Hash: 9E31C731900A17BBEB109BB8AC68AAF77BAEF04760F150115F954E73A0D730D945AF90

Function 00629326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00629DD7,?,00000022,?,?,00000000,00000001), ref: 00629340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00629DD7,?,00000022,?,?,00000000,00000001), ref: 0062936E
GetModuleFileNameA.KERNEL32(00000000,?,00629DD7,?,00000022,?,?,00000000,00000001), ref: 00629375
wsprintfA.USER32 ref: 006293CE
wsprintfA.USER32 ref: 0062940C
wsprintfA.USER32 ref: 0062948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 006294F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00629526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00629571

Strings

runas, xrefs: 00629674

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b2492595f9220d5c647a07eda9ac2a2c3e8366f4f500f04951c30f780c4d6206
Instruction ID: 3b23700a5bdf6d2e3302140e1091711d0f829cd7355265ef7ceb74335b71ed9d
Opcode Fuzzy Hash: b2492595f9220d5c647a07eda9ac2a2c3e8366f4f500f04951c30f780c4d6206
Instruction Fuzzy Hash: E0A191B1900629AFFB25DFA0EC95FDE3BAEEB44740F10402AFA0596151E775D944CFA0

Function 00622011 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00622078
GetTickCount.KERNEL32 ref: 006220D4
GetTickCount.KERNEL32 ref: 006220DB
GetTickCount.KERNEL32 ref: 0062212B
GetTickCount.KERNEL32 ref: 00622132
GetTickCount.KERNEL32 ref: 00622142

Part of subcall function 0062F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0062E342,00000000,75A8EA50,80000001,00000000,0062E513,?,00000000,00000000,?,000000E4), ref: 0062F089
Part of subcall function 0062F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0062E342,00000000,75A8EA50,80000001,00000000,0062E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0062F093

Part of subcall function 0062E854: lstrcpyA.KERNEL32(00000001,?,?,0062D8DF,00000001,localcfg,except_info,00100000,00630264), ref: 0062E88B
Part of subcall function 0062E854: lstrlenA.KERNEL32(00000001,?,0062D8DF,00000001,localcfg,except_info,00100000,00630264), ref: 0062E899

Part of subcall function 00621C5F: wsprintfA.USER32 ref: 00621CE1

Strings

net_type, xrefs: 006221DF
ha, xrefs: 006220DD, 0062212D
rbl_bl, xrefs: 00622181
rbl_ip, xrefs: 0062218F
localcfg, xrefs: 00622070, 00622160, 00622186, 00622194, 006221E4

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: ha$localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-4192562019
Opcode ID: 9e26af18b60360c8c713053192abe63274cea62f395b5b0bf17e255c17267e0e
Instruction ID: be0fb01884fcded25f9ffc023b42e229c4bb8dc9d87774d7ec2c81c8986aac94
Opcode Fuzzy Hash: 9e26af18b60360c8c713053192abe63274cea62f395b5b0bf17e255c17267e0e
Instruction Fuzzy Hash: EF51F570904B576EE728EF34FD79B973BE7EB11310F10102DE601862A1DBB49A88CE95

Function 0062B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0062B467

Part of subcall function 0062EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0062EF92
Part of subcall function 0062EF7C: lstrlenA.KERNEL32(?), ref: 0062EF99
Part of subcall function 0062EF7C: lstrlenA.KERNEL32(00000000), ref: 0062EFA0

Strings

%TO_USER, xrefs: 0062B488
%s@%s, xrefs: 0062B461
%TO_HASH, xrefs: 0062B4B0
%P5DATE, xrefs: 0062B4F2
%TO_DOMAIN, xrefs: 0062B44B
%DATE, xrefs: 0062B4D2
%FROM_USER, xrefs: 0062B431
%M5DATE, xrefs: 0062B50F
%FROM_DOMAIN, xrefs: 0062B41E
%FROM_EMAIL, xrefs: 0062B3E9
%TO_EMAIL, xrefs: 0062B473

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: bd6d7ef4a0e706b731dea710e0126b74499667b2d359474d127497a7018b7c33
Instruction ID: d788ae7113e136b5f4c6f97f7bc28a13bbbf93d31f6cbd958b46c5905130b2da
Opcode Fuzzy Hash: bd6d7ef4a0e706b731dea710e0126b74499667b2d359474d127497a7018b7c33
Instruction Fuzzy Hash: 6F4174B25405287EEF00AB94ECC2CFF7B6EEF49348F140129F904A2142DB71AA158BB5

Function 0062C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0062A4C7: GetTickCount.KERNEL32 ref: 0062A4D1
Part of subcall function 0062A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0062A4FA

GetTickCount.KERNEL32 ref: 0062C31F
GetTickCount.KERNEL32 ref: 0062C32B
GetTickCount.KERNEL32 ref: 0062C363
GetTickCount.KERNEL32 ref: 0062C378
GetTickCount.KERNEL32 ref: 0062C44D
InterlockedIncrement.KERNEL32(0062C4E4), ref: 0062C4AE
CreateThread.KERNEL32(00000000,00000000,0062B535,00000000,?,0062C4E0), ref: 0062C4C1
CloseHandle.KERNEL32(00000000,?,0062C4E0,00633588,00628810), ref: 0062C4CC

Strings

localcfg, xrefs: 0062C2DD

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 79c464a42ba66bd5be480acccabdcc9f17023f7e04567fd7cd3782e3bec69891
Instruction ID: 95e306a2a66a1f79564602282b5a598fcdda8d985541a9e83db495bbe1145a1f
Opcode Fuzzy Hash: 79c464a42ba66bd5be480acccabdcc9f17023f7e04567fd7cd3782e3bec69891
Instruction Fuzzy Hash: 7D518AB1A00B518FD764DF69D69452ABBEAFB48310B509D3EE18BC7A90D770F8448F50

Function 0062BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0062BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0062BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0062BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0062BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0062BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0062BF94

Strings

smtp_ban, xrefs: 0062BE55, 0062BF77
smtp_retr, xrefs: 0062BE61, 0062BF8C
smtp_herr, xrefs: 0062BE46, 0062BF62

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 42958b537ad3846ed0ef462470acc32080eec09db6ca04f67bcfc4a4b2a17679
Instruction ID: 33b040b87c04b229c0cd0a2a7d1332e116ac9911dad17f5f4d13ad066a8ce17b
Opcode Fuzzy Hash: 42958b537ad3846ed0ef462470acc32080eec09db6ca04f67bcfc4a4b2a17679
Instruction Fuzzy Hash: AF51D471A00A26EFDB118F64EE50B99BBABEF04384F156069E9819B351D730ED45CF90

Function 00626A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00629A60,?,?,00629E9D), ref: 00626A7D
GetDiskFreeSpaceA.KERNEL32(00629E9D,00629A60,?,?,?,006322F8,?,?,?,00629A60,?,?,00629E9D), ref: 00626ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00629A60,?,?,00629E9D), ref: 00626B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00629A60,?,?,00629E9D), ref: 00626B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00629A60,?,?,00629E9D), ref: 00626B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00629A60,?,?,00629E9D), ref: 00626B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00629A60,?,?,00629E9D), ref: 00626B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00629A60,?,?,00629E9D), ref: 00626B80
GetLastError.KERNEL32(?,?,?,00629A60,?,?,00629E9D,?,?,?,?,?,00629E9D,?,00000022,?), ref: 00626B96

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: d23c255ad0d6f25bdb75b7162b0e5ba4d2a91c120658c403a2cfcdf17a03639d
Instruction ID: 377c6ce8127437beda8d87ea16b43c939df60e174787ab9a822e3058c1801036
Opcode Fuzzy Hash: d23c255ad0d6f25bdb75b7162b0e5ba4d2a91c120658c403a2cfcdf17a03639d
Instruction Fuzzy Hash: A831107290061EAFDB019FA4ED94ADEBB7BEB48300F14406AF211E3251D7309A558FA1

Function 00626F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0062D7C3), ref: 00626F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0062D7C3), ref: 00626FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00626FE8
LocalFree.KERNEL32(00000120), ref: 0062701F
wsprintfA.USER32 ref: 00627036

Strings

/%d, xrefs: 00627030
|, xrefs: 00626FB3

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 7b5c8d21c6944e5eefff18d0a53704f3037a85bce0dbea05d0321e5a46d9340a
Instruction ID: 58f37c82f1b8815db0bf45c3d13206b67327589623b3d25c02bb4543537d03d5
Opcode Fuzzy Hash: 7b5c8d21c6944e5eefff18d0a53704f3037a85bce0dbea05d0321e5a46d9340a
Instruction Fuzzy Hash: F1313A72904118ABDB01DFA8EC59EDE7BBDEF04310F048066F859DB241EA35DA08CF94

Function 00626CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,006322F8,000000E4,00626DDC,000000C8), ref: 00626CE7
GetProcAddress.KERNEL32(00000000), ref: 00626CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00626D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00626D2B

Strings

kernel32, xrefs: 00626CE2
GetSystemWow64DirectoryA, xrefs: 00626CDD
C:\Windows\SysWOW64\, xrefs: 00626CC9, 00626CD1, 00626CFE, 00626D05, 00626D13, 00626D1E, 00626D2A, 00626D42, 00626D5F, 00626D85

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 7ca13c0d8a0751ff717cd055931d44d142bd048a19f8675e2b672cfefec26675
Instruction ID: 98237a5f2176c508feb0751aa9eda347675db7f6dc96f6c77e4233130624b231
Opcode Fuzzy Hash: 7ca13c0d8a0751ff717cd055931d44d142bd048a19f8675e2b672cfefec26675
Instruction Fuzzy Hash: 84213B71741A6A3AF7215732BCAAFB72E4F8F13704F0C8454F404A6291CA9588498BE5

Function 0062977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00629947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,006322F8), ref: 006297B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,006322F8), ref: 006297EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,006322F8), ref: 006297F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,006322F8), ref: 00629831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,006322F8), ref: 0062984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,006322F8), ref: 0062985B

Strings

D, xrefs: 006297A9

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: d76a61b6b0d4b443ed478bed895208cda647981e51d7288db8535900e384f885
Instruction ID: eb68cabe878bfd40850ca9a7b1028cfce94cd14c5e26f55a49d7b878d01775d4
Opcode Fuzzy Hash: d76a61b6b0d4b443ed478bed895208cda647981e51d7288db8535900e384f885
Instruction Fuzzy Hash: B8210C71901229BBEB219FA1EC49EEF7B7EEF05754F000465F919E1150EB719A44CEA0

Function 0062E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062DD05: GetTickCount.KERNEL32 ref: 0062DD0F
Part of subcall function 0062DD05: InterlockedExchange.KERNEL32(006336B4,00000001), ref: 0062DD44
Part of subcall function 0062DD05: GetCurrentThreadId.KERNEL32 ref: 0062DD53

Part of subcall function 0062DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0062DDB5

lstrcpynA.KERNEL32(?,00621E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0062EAAA,?,?), ref: 0062E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0062EAAA,?,?,00000001,?,00621E84,?), ref: 0062E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0062EAAA,?,?,00000001,?,00621E84,?,0000000A), ref: 0062E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0062EAAA,?,?,00000001,?,00621E84,?), ref: 0062E94F

Strings

flags_upd, xrefs: 0062E8A7
localcfg, xrefs: 0062E8AB

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: f45b2e7e7a163ad9b85ec47ed8308d876b2f7a77be1fadb6abe135ba0b14524e
Instruction ID: 58a376ae873e689a602f392bfeec4c3f51d5d2515ba2281db92ad1d00b5aa3c4
Opcode Fuzzy Hash: f45b2e7e7a163ad9b85ec47ed8308d876b2f7a77be1fadb6abe135ba0b14524e
Instruction Fuzzy Hash: B9514F7290061AAFCF00EFA8D985DAEB7FAFF48304F14052EE415A7211DB35EA158F54

Function 00626BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00626BB2

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: db82284509f46e561837fb23430583331bcdbb877ea0ee005df754dc475e0496
Instruction ID: f0ce5efd64fc38ddf9f5c4fc6a9137442ed92106a05a5e3908281ce8f8aadd26
Opcode Fuzzy Hash: db82284509f46e561837fb23430583331bcdbb877ea0ee005df754dc475e0496
Instruction Fuzzy Hash: F021A472204525FFEB1467A0FD49DEF3A6EDB44351B101415F502E1190EB319A00DBB4

Function 00629064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,006322F8), ref: 0062907B
wsprintfA.USER32 ref: 006290E9
CreateFileA.KERNEL32(006322F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0062910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00629122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0062912D
CloseHandle.KERNEL32(00000000), ref: 00629134

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: b6db242d06adce9ba9c39c7378854e57dd459dbf18fd02bbb43a0206f1afd85f
Instruction ID: 180d9c4f20edc562b4feb8b1741395585a03ad63169dec3bf353bcd798c8381e
Opcode Fuzzy Hash: b6db242d06adce9ba9c39c7378854e57dd459dbf18fd02bbb43a0206f1afd85f
Instruction Fuzzy Hash: BB1187B26405247BF7646B72EC1EFAF367FDBC4B00F008069BB0AA5151EA704A159AA5

Function 0062DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0062DD0F
GetCurrentThreadId.KERNEL32 ref: 0062DD20
GetTickCount.KERNEL32 ref: 0062DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0062E538,?,74DF0F10,?,00000000,?,0062A445), ref: 0062DD3B
InterlockedExchange.KERNEL32(006336B4,00000001), ref: 0062DD44
GetCurrentThreadId.KERNEL32 ref: 0062DD53

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 5db5d968a3af636bda0e1180ced112e1d47ea40d64682e1da9637a7d794c28b4
Instruction ID: 204008ed161ce310ac9214e060d3681696ba8c80891bc0f319c832f18b32d95b
Opcode Fuzzy Hash: 5db5d968a3af636bda0e1180ced112e1d47ea40d64682e1da9637a7d794c28b4
Instruction Fuzzy Hash: 8AF08272104A24AFE7845B66BDC9B697BA7EB45312F102415F509C6361C72095498FE2

Function 0062AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0062AD1C
lstrlenA.KERNEL32(00000000), ref: 0062AD60
lstrlenA.KERNEL32(00000000), ref: 0062AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0062AD7F

Strings

LocalHost, xrefs: 0062AD79

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 0d40db74cd863e86bf267c284ea8be1cf37f75ee7027fd78b58055d2d6bc7be2
Instruction ID: 596ca830b4ef7c8e2e7deecd5f0e0c1d92945ed67aa6297114657e7e9fef45c7
Opcode Fuzzy Hash: 0d40db74cd863e86bf267c284ea8be1cf37f75ee7027fd78b58055d2d6bc7be2
Instruction Fuzzy Hash: 860189308445A95FDF3107A8B844BE43F679F92706F100856D0C0CB611D79488478F97

Function 00624BD1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00624BDD
GetTickCount.KERNEL32 ref: 00624BEC
Sleep.KERNEL32(00000000,?,%FROM_EMAIL,00625D02,00000000,?,0062B85C,?,00000080,?,00000000,00000000,?,%FROM_EMAIL), ref: 00624BF9
InterlockedExchange.KERNEL32(00A2C0B8,00000001), ref: 00624C02

Strings

%FROM_EMAIL, xrefs: 00624BD1

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID: %FROM_EMAIL
API String ID: 2207858713-2903620461
Opcode ID: 75ddeec875c4736c5c2deb1a07063dee35934b3fc179d63138af4c06d762d21c
Instruction ID: d6bf5ba3a5fd9990653510e36884a01caf87e769d3179bd686c5486b1e11afad
Opcode Fuzzy Hash: 75ddeec875c4736c5c2deb1a07063dee35934b3fc179d63138af4c06d762d21c
Instruction Fuzzy Hash: F1E07D3330122417D70013B97C80F96735EDB45363F020072FB08C2150CE52D40145F1

Function 00624280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,006298FD,00000001,00000100,006322F8,0062A3C7), ref: 00624290
CloseHandle.KERNEL32(0062A3C7), ref: 006243AB
CloseHandle.KERNEL32(00000001), ref: 006243AE

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 4faee7ab246ff4d8c4d12c13bff7e80f9bd3a10c161715e7b8e71485e65bfa8b
Instruction ID: efd1a05e79e1a5129a9d9cf2a5eaad52c831219913e6c8dbe30667cb90ecad19
Opcode Fuzzy Hash: 4faee7ab246ff4d8c4d12c13bff7e80f9bd3a10c161715e7b8e71485e65bfa8b
Instruction Fuzzy Hash: 8341A2B1D00629BADB10ABA2ED46FEF7FBAEF00320F105155F615A6281DB348641DFA0

Function 00626069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0062609C
LoadLibraryA.KERNEL32(?,?,006264CF,00000000), ref: 006260C3
GetProcAddress.KERNEL32(?,00000014), ref: 0062614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0062619E

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 5bb2a92f659c88fff28ff53bec97f5dbe357053372a323f5691121037a0fcc8b
Instruction ID: a12d9b344a181d011afc14ca41e4383f18bca77d4e5e46389ab5d0d1504fda38
Opcode Fuzzy Hash: 5bb2a92f659c88fff28ff53bec97f5dbe357053372a323f5691121037a0fcc8b
Instruction Fuzzy Hash: 70416A71A00925ABEB14CF58E888AA9B7B6EF14354F248068F815D7391D730FD65DF80

Function 00622923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ee3f7efd04f151e7898dd417f281f310062d58ca638073aa4507504ab825e1
Instruction ID: a3642f6eecd9b28691f1bbcca503cc68962f1d0061f17126d4f63f14edd8062b
Opcode Fuzzy Hash: 14ee3f7efd04f151e7898dd417f281f310062d58ca638073aa4507504ab825e1
Instruction Fuzzy Hash: E831C071A0062ABBDB108FA5DC91ABEB7F5FF48701F10445AE544EA241E378DA51CF64

Function 006226FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0062272E
htons.WS2_32(00000001), ref: 00622752
htons.WS2_32(0000000F), ref: 006227D5
htons.WS2_32(00000001), ref: 006227E3
sendto.WS2_32(?,00632BF8,00000009,00000000,00000010,00000010), ref: 00622802

Part of subcall function 0062EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0062EBFE,7FFF0001,?,0062DB55,7FFF0001), ref: 0062EBD3
Part of subcall function 0062EBCC: RtlAllocateHeap.NTDLL(00000000,?,0062DB55,7FFF0001), ref: 0062EBDA

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: f16ed51fb49a9a33db4c36be5bce6f0bdb3f87d9655e265ee77acd972725b5cc
Instruction ID: b8f8eaa7244d9538ae162b5412fa0d9048b29ef49bb46755179c878dfce9d1bf
Opcode Fuzzy Hash: f16ed51fb49a9a33db4c36be5bce6f0bdb3f87d9655e265ee77acd972725b5cc
Instruction Fuzzy Hash: 97314C38244393BFD7108F74FCB09A2B7A2EF19318B19506DD856CB362D632D842DB90

Function 00629145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,006322F8), ref: 0062915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00629166
CharToOemA.USER32(?,?), ref: 00629174
wsprintfA.USER32 ref: 006291A9

Part of subcall function 00629064: GetTempPathA.KERNEL32(00000400,?,00000000,006322F8), ref: 0062907B
Part of subcall function 00629064: wsprintfA.USER32 ref: 006290E9
Part of subcall function 00629064: CreateFileA.KERNEL32(006322F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0062910E
Part of subcall function 00629064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00629122
Part of subcall function 00629064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0062912D
Part of subcall function 00629064: CloseHandle.KERNEL32(00000000), ref: 00629134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 006291E1

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 444cf5aecb4fdb403d601c5022c0b78de1ae499acddb85c3925adcfafde92bb8
Instruction ID: 135098fea4265545d6a7c53653550a5b2b8211c82016c80c240cdd5861685ac6
Opcode Fuzzy Hash: 444cf5aecb4fdb403d601c5022c0b78de1ae499acddb85c3925adcfafde92bb8
Instruction Fuzzy Hash: 320175F69005197BEB60ABA19D8DEDF7B7DDB95701F0000A5B749E2050D6B09789CFB0

Function 00622419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00622491,?,?,?,0062E844,-00000030,?,?,?,00000001), ref: 00622429
lstrlenA.KERNEL32(?,?,00622491,?,?,?,0062E844,-00000030,?,?,?,00000001,00621E3D,00000001,localcfg,lid_file_upd), ref: 0062243E
lstrcmpiA.KERNEL32(?,?), ref: 00622452
lstrlenA.KERNEL32(?,?,00622491,?,?,?,0062E844,-00000030,?,?,?,00000001,00621E3D,00000001,localcfg,lid_file_upd), ref: 00622467

Strings

localcfg, xrefs: 0062241F

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 10716da99685e5b26585d12948f48b749a1c99813399c94034162d1c7101421e
Instruction ID: 4d7e3ccf520b1e00828cb9f68dcaf5d690836d96d257b759efa9e5f6bfa27c51
Opcode Fuzzy Hash: 10716da99685e5b26585d12948f48b749a1c99813399c94034162d1c7101421e
Instruction Fuzzy Hash: 9D011A3160062ABF8F11EF69DC908DE7BEAEF44354B51C425F8599B210E330EA448E90

Function 00626EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00626F0F
CheckTokenMembership.ADVAPI32(00000000,?,*pb), ref: 00626F24
FreeSid.ADVAPI32(?), ref: 00626F3E

Strings

*pb, xrefs: 00626F1C, 00626F1F

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *pb
API String ID: 3429775523-1176003494
Opcode ID: 97e947a2a0eb9274b3087d07087060fbc84e5cf12458eeb1edd0398c789dacf7
Instruction ID: 29399f3c87b1dc0e417e1090f6e82c15888200cba0648e83732aa65240f55d22
Opcode Fuzzy Hash: 97e947a2a0eb9274b3087d07087060fbc84e5cf12458eeb1edd0398c789dacf7
Instruction Fuzzy Hash: 50011EB1904219AFEB14DFE4FDD5AAD77BAEB04300F105869F205E2161E7709948CF54

Function 00621C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00621CE1
wsprintfA.USER32 ref: 00621D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00621CDB, 00621D65
localcfg, xrefs: 00621C70

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 677f5035059b4030e88ad642c8d97fb2b551b8b93f374aedb6aa04431c79342f
Instruction ID: a30b78f944f20c7bdb4a2bb333586024162aaea5818b3bf2daac6fe8d39e802b
Opcode Fuzzy Hash: 677f5035059b4030e88ad642c8d97fb2b551b8b93f374aedb6aa04431c79342f
Instruction Fuzzy Hash: 1941DF729046A99FDB31CF789C44BEE3BE99F4A300F240455F9A0D7242D635DA05CFA0

Function 0062E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0062DD05: GetTickCount.KERNEL32 ref: 0062DD0F
Part of subcall function 0062DD05: InterlockedExchange.KERNEL32(006336B4,00000001), ref: 0062DD44
Part of subcall function 0062DD05: GetCurrentThreadId.KERNEL32 ref: 0062DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00625EC1), ref: 0062E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00625EC1), ref: 0062E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,74DF0F10,00000000,?,00625EC1), ref: 0062E722

Strings

89ABCDEF, xrefs: 0062E721

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: d14e8beb563956e5619d66891abcd3a956e8ff3740ae13d744ca9c855586bca8
Instruction ID: 5652e1c6516780bfed3556c95387ef9b21ced4555bdcb3fae78e513abbc499fc
Opcode Fuzzy Hash: d14e8beb563956e5619d66891abcd3a956e8ff3740ae13d744ca9c855586bca8
Instruction Fuzzy Hash: 7231BE31604F22DBDB358F64E884BA67BE6AF21321F10843EE45687650D772E884CF81

Function 0062E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0062E2A3,00000000,00000000,00000000,00020106,00000000,0062E2A3,00000000,000000E4), ref: 0062E0B2
RegSetValueExA.ADVAPI32(0062E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,006322F8), ref: 0062E127
RegDeleteValueA.ADVAPI32(0062E2A3,?,?,?,?,?,000000C8,006322F8), ref: 0062E158
RegCloseKey.ADVAPI32(0062E2A3,?,?,?,?,000000C8,006322F8,?,?,?,?,?,?,?,?,0062E2A3), ref: 0062E161

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: f579254a75ede5e39529f704a8e717be68d8d6f4e04bb4c5f1f84a2ce4f3cafb
Instruction ID: 274a9b1e23f2b54e0b89f1f4cee749c56a5f800e475bad485b51dd04295bb477
Opcode Fuzzy Hash: f579254a75ede5e39529f704a8e717be68d8d6f4e04bb4c5f1f84a2ce4f3cafb
Instruction Fuzzy Hash: F3216F71A00229BBDF209FA4EC89EDE7F7AEF09750F004071F904E6151E7728A25DBA0

Function 00623F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0062A3C7,00000000,00000000,000007D0,00000001), ref: 00623F44
GetLastError.KERNEL32 ref: 00623F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00623F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00623F72

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 33e633220db2eaa5d18ee3b97b426eac1c455a6a2ab19fe2179fc438f66f661d
Instruction ID: ed3451978ad26edb41431b822ea1bc3312ec76997682c72c663013d131db9870
Opcode Fuzzy Hash: 33e633220db2eaa5d18ee3b97b426eac1c455a6a2ab19fe2179fc438f66f661d
Instruction Fuzzy Hash: FB01D372911129ABEB01DF91EE84BEE7BBDEB04395F104025FA01E6250D7349A158BB2

Function 00623F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0062A3C7,00000000,00000000,000007D0,00000001), ref: 00623FB8
GetLastError.KERNEL32 ref: 00623FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00623FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00623FE6

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: d1fcd7958cde56c0a8c49f20e6f828fea5e3a9a6004174dcafa6f86201b628b8
Instruction ID: d53429803a2165d7d05b2db0fec3cdd5874ba04d00f52268054f47054d2c13ad
Opcode Fuzzy Hash: d1fcd7958cde56c0a8c49f20e6f828fea5e3a9a6004174dcafa6f86201b628b8
Instruction Fuzzy Hash: D001057291022AABDF01DF90EE85BEA3B79AB04355F004011ED02E2190D7349A14CFB1

Function 0062A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0062A4D1
GetTickCount.KERNEL32 ref: 0062A4E4
Sleep.KERNEL32(00000000,?,0062C2E9,0062C4E0,00000000,localcfg,?,0062C4E0,00633588,00628810), ref: 0062A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0062A4FA

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 55eb867184b44f833747a3413df8bad69b6c8f92832e482ff5ff73b2c53edc81
Instruction ID: 2ab1a855f4c199b60bbeef26360a781252c5f9f868e5aced33f72607663ba58e
Opcode Fuzzy Hash: 55eb867184b44f833747a3413df8bad69b6c8f92832e482ff5ff73b2c53edc81
Instruction Fuzzy Hash: 9EE0263320022457D70067E5BD84FAA33CAEB4D761F110061FA04E3240C796E84549F3

Function 00624E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00624E9E
GetTickCount.KERNEL32 ref: 00624EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00624EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00624EC3

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 8ef0c14118ce07d9ddcdac3fea88e336c08111beaa93400f40ca82ebf487b83b
Instruction ID: e589274cc4c834dfc2ed3f5acfa007284ea15ab36a794cd3c04d950a39b48b34
Opcode Fuzzy Hash: 8ef0c14118ce07d9ddcdac3fea88e336c08111beaa93400f40ca82ebf487b83b
Instruction Fuzzy Hash: 7EE0263220062417F70023B9FC80F5A664BAB55360F020131E608C2180CA56D80209F1

Function 006230FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00623103
GetTickCount.KERNEL32 ref: 0062310F
Sleep.KERNEL32(00000000), ref: 0062311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00623128

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 673d8eda3b33e16c99cf4294e84c2fc6d034537f992d7663e507bffd5b6cfc82
Instruction ID: 30c9153a7e8d264c42bf9155c257fd6dc20cb1b66c2246fc9806a08a92c84a11
Opcode Fuzzy Hash: 673d8eda3b33e16c99cf4294e84c2fc6d034537f992d7663e507bffd5b6cfc82
Instruction Fuzzy Hash: D1E02B31300335AFEB002B75BE48B897B5BDF84761F111031F601D26B0C7548D258DB1

Function 00626987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00629A60,?,?,00000000,00000000,00629A60,?,00000000), ref: 006269F9
WriteFile.KERNEL32(00629A60,?,00629A60,00000000,00000000), ref: 00626A27

Strings

,kb, xrefs: 006269A7, 006269D5

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,kb
API String ID: 3934441357-3953382542
Opcode ID: dd5d75ed604f95efd200486039156732f028315ddc3a4ca8561cd8b1cf260107
Instruction ID: 4c1b1061f458856687256d61478238be18fff399b5fc758eb20449f09e46cb1b
Opcode Fuzzy Hash: dd5d75ed604f95efd200486039156732f028315ddc3a4ca8561cd8b1cf260107
Instruction Fuzzy Hash: CA313872A00619EFDB24DF68E985BAAB7F5EB04315F10846AF801E7240D770EE54CFA1

Function 00628CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00628D02
GetTickCount.KERNEL32 ref: 00628DA1

Strings

localcfg, xrefs: 00628D19

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 2ead68a1faa20498879c2e06c7175a5df96238c58ed4149aeb4d3b7f93a4450b
Instruction ID: 53af403c44d1ddbfc43830f1a81c9114c59d02ea16b7a5e9b7de5fc237e543b6
Opcode Fuzzy Hash: 2ead68a1faa20498879c2e06c7175a5df96238c58ed4149aeb4d3b7f93a4450b
Instruction Fuzzy Hash: D921D532612A31AFDB108FB4EC9159A77BBEF20351B294859D401DB291CF34ED48CF51

Function 0062BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0062BFD0
wsprintfA.USER32 ref: 0062C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0062C057

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: c5aeb4513c354700d7e8763f37e58d36e5465b95cc328fc9ce5edd3f622cae83
Instruction ID: d9e3b3ea432da0992692f664e1f0e5075fd303a87514d44502adc608c1c10241
Opcode Fuzzy Hash: c5aeb4513c354700d7e8763f37e58d36e5465b95cc328fc9ce5edd3f622cae83
Instruction Fuzzy Hash: 0E118672100100EFDB429BA9CD44E567FA6FF88318B34919CF6188A166D633D867EB90

Function 006238F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 006230FA: GetTickCount.KERNEL32 ref: 00623103
Part of subcall function 006230FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00623128

GetCurrentThreadId.KERNEL32 ref: 00623929
GetCurrentThreadId.KERNEL32 ref: 00623939

Strings

%FROM_EMAIL, xrefs: 00623913

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: b456b495f62a90dd7b05f6868c6ac86d119256324a8e55d52ddd3ee38e86739f
Instruction ID: 9727c5d1660a2d1c9b68d1b08e8573b2940171c1efe422e7c2864d6b68bae03e
Opcode Fuzzy Hash: b456b495f62a90dd7b05f6868c6ac86d119256324a8e55d52ddd3ee38e86739f
Instruction Fuzzy Hash: 16116AB1900625EFD760DF0AE481A9CF3F6FB09715F10851EE84497391D7B4AA80CFA4

Function 0062AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0062BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0062ABB9
InterlockedIncrement.KERNEL32(00633640), ref: 0062ABE1

Strings

%FROM_EMAIL, xrefs: 0062AB8C

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 76736b2b1d9658d79be901fdaeedc8cc25712d4924d74904e5f1196b08c869cb
Instruction ID: dc0ef67f1fc5a7a6967618cbe56c4df80379ba25b58e21b325973179b660021a
Opcode Fuzzy Hash: 76736b2b1d9658d79be901fdaeedc8cc25712d4924d74904e5f1196b08c869cb
Instruction Fuzzy Hash: 1E019E315082A4AFDB11CF58E991E967BA7AF15315F1544C4E58087353C3B0EA44CF92

Function 006226B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 006226C3
inet_ntoa.WS2_32(?), ref: 006226E4

Strings

localcfg, xrefs: 006226CD, 006226D2, 006226DE

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 2ed44bc4779b2b92e73cb32d725285046c7bcfc845b02a22d2d89f573855d26d
Instruction ID: a646c20ddbd07a6a1b04a8e96421b10d20f7218da2922e5178e84982614139f6
Opcode Fuzzy Hash: 2ed44bc4779b2b92e73cb32d725285046c7bcfc845b02a22d2d89f573855d26d
Instruction Fuzzy Hash: 06F0123324861A7BEB046FA4FC19E9A379EDF09750F144465F908DA190DB71D9409B98

Function 0062EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0062EB54,_alldiv,0062F0B7,80000001,00000000,00989680,00000000,?,?,?,0062E342,00000000,75A8EA50,80000001,00000000), ref: 0062EAF2
GetProcAddress.KERNEL32(76E90000,00000000), ref: 0062EB07

Strings

ntdll.dll, xrefs: 0062EAED

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 25d0a873e718d76b7030445c0289f84f5198e39835d2e8cc4da00c3261fe0db2
Instruction ID: 12ceb255e403e34a29ae0b1fd7ac9248cacbb158e00eebc59e04a146d0485089
Opcode Fuzzy Hash: 25d0a873e718d76b7030445c0289f84f5198e39835d2e8cc4da00c3261fe0db2
Instruction Fuzzy Hash: 6AD0C934A04712AB9F164F64EF5B95576EBAB55702B406065A41AC1320E731D888DA80

Function 00622F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00622D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00622F01,?,006220FF,00632000), ref: 00622D3A
Part of subcall function 00622D21: LoadLibraryA.KERNEL32(?), ref: 00622D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00622F73
HeapFree.KERNEL32(00000000), ref: 00622F7A

Memory Dump Source

Source File: 0000000C.00000002.2951374424.0000000000620000.00000040.00000400.00020000.00000000.sdmp, Offset: 00620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_620000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 955abf861a39d4104a740272ccbb38fc8d2e2f99dfc2576420e9992e4a91ce3c
Instruction ID: 29b4d6b8b573432d90dbc731d1e1452a52604fdeed939f199631ec6285943ebc
Opcode Fuzzy Hash: 955abf861a39d4104a740272ccbb38fc8d2e2f99dfc2576420e9992e4a91ce3c
Instruction Fuzzy Hash: 9951AD7190062AAFDF019F64E8989FAB776FF15304F1045A9EC96D7310E7329A19CF90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2FnvReiPU6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\upwtsplm.exe

C:\Windows\SysWOW64\crxslmyv\upwtsplm.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
2FnvReiPU6.exe

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Function 0071007E Relevance: 7.6, APIs: 5, Instructions: 131
memoryCOMMON

Function 0040EC2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
memoryCOMMONLIBRARYCODE

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 330
registryCOMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre