Edit tour

Windows Analysis Report
LtmV2sDcTK.exe

Overview

General Information

Sample name:	LtmV2sDcTK.exe renamed because original name is a hash value
Original sample name:	98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf.exe
Analysis ID:	1508522
MD5:	2e7c2fa8c75a99967dbf0d6ccf82d0df
SHA1:	87f9c8377d643cb2d749debfc999e002201ca292
SHA256:	98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf
Tags:	116-198-231-169exe
Infos:

Detection

CobaltStrike, Metasploit

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected Metasploit Payload

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

One or more processes crash

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

LtmV2sDcTK.exe (PID: 5248 cmdline: "C:\Users\user\Desktop\LtmV2sDcTK.exe" MD5: 2E7C2FA8C75A99967DBF0D6CCF82D0DF)

WerFault.exe (PID: 3304 cmdline: C:\Windows\system32\WerFault.exe -u -p 5248 -s 1224 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"C2Server": "http://116.198.231.169:63222/jquery-3.3.2.slim.min.js", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n"}

Threatname: Metasploit

{"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://code.jquery.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://116.198.231.169/jquery-3.3.2.slim.min.js"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB6.tmp.dmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x1bc91:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB6.tmp.dmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x1bcfd:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0xe81:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0xeed:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T10:58:41.962223+0200	2028765	3	Unknown Traffic	192.168.2.5	49704	116.198.231.169	63222	TCP
2024-09-10T10:58:46.106093+0200	2028765	3	Unknown Traffic	192.168.2.5	49707	116.198.231.169	63222	TCP
2024-09-10T10:58:50.183653+0200	2028765	3	Unknown Traffic	192.168.2.5	49710	116.198.231.169	63222	TCP
2024-09-10T10:58:54.361605+0200	2028765	3	Unknown Traffic	192.168.2.5	49713	116.198.231.169	63222	TCP
2024-09-10T10:58:58.813542+0200	2028765	3	Unknown Traffic	192.168.2.5	49717	116.198.231.169	63222	TCP
2024-09-10T10:59:02.907545+0200	2028765	3	Unknown Traffic	192.168.2.5	49724	116.198.231.169	63222	TCP
2024-09-10T10:59:06.958588+0200	2028765	3	Unknown Traffic	192.168.2.5	49727	116.198.231.169	63222	TCP
2024-09-10T10:59:10.992677+0200	2028765	3	Unknown Traffic	192.168.2.5	49730	116.198.231.169	63222	TCP
2024-09-10T10:59:14.951779+0200	2028765	3	Unknown Traffic	192.168.2.5	49733	116.198.231.169	63222	TCP
2024-09-10T10:59:19.061173+0200	2028765	3	Unknown Traffic	192.168.2.5	49736	116.198.231.169	63222	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LtmV2sDcTK.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp	Malware Configuration Extractor: CobaltStrike {"C2Server": "http://116.198.231.169:63222/jquery-3.3.2.slim.min.js", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n"}
Source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp	Malware Configuration Extractor: Metasploit {"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://code.jquery.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://116.198.231.169/jquery-3.3.2.slim.min.js"}

Multi AV Scanner detection for submitted file

Source: LtmV2sDcTK.exe	ReversingLabs: Detection: 60%
Source: LtmV2sDcTK.exe	Virustotal: Detection: 37%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: LtmV2sDcTK.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://116.198.231.169:63222/jquery-3.3.2.slim.min.js
Source: Malware configuration extractor	URLs: http://116.198.231.169/jquery-3.3.2.slim.min.js

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 116.198.231.169:63222

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49707 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49710 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49704 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49713 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49717 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49730 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49727 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49724 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49736 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49733 -> 116.198.231.169:63222

Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169

Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000002.2948541073.000002545502A000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000003.2465339472.000002545502A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/
Source: LtmV2sDcTK.exe, 00000000.00000003.2424244410.000002545502A000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000003.2445008563.000002545502A000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000002.2948541073.000002545502A000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000003.2465339472.000002545502A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/B
Source: LtmV2sDcTK.exe, 00000000.00000003.2424244410.000002545502A000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000003.2445008563.000002545502A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/G
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/q
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025455013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169/
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/AppData
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/al
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/bV=1
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/dll
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454F9C000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025455013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.js
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.js=
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454F9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsRjC1
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsU
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsingsm
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.jskies
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsock
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454F9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.jszjk1

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB6.tmp.dmp, type: DROPPED	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB6.tmp.dmp, type: DROPPED	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown

Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Code function: 0_2_00007FF7026E1154	0_2_00007FF7026E1154
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Code function: 0_2_00007FF7026E19E0	0_2_00007FF7026E19E0
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Code function: 0_2_00007FF7026E2E90	0_2_00007FF7026E2E90
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Code function: 0_2_00007FF7026E1423	0_2_00007FF7026E1423
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Code function: 0_2_00007FF7026E1CB2	0_2_00007FF7026E1CB2
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Code function: 0_2_0000006AD78FDF42	0_2_0000006AD78FDF42

Source: C:\Users\user\Desktop\LtmV2sDcTK.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5248 -s 1224

Source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB6.tmp.dmp, type: DROPPED	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB6.tmp.dmp, type: DROPPED	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23

Source: classification engine

Classification label: mal96.troj.winEXE@2/5@0/1

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5248

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9b6e7674-c3db-4773-96c5-fe9eedb31e25

Jump to behavior

Source: LtmV2sDcTK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\LtmV2sDcTK.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LtmV2sDcTK.exe	ReversingLabs: Detection: 60%
Source: LtmV2sDcTK.exe	Virustotal: Detection: 37%

Source: unknown	Process created: C:\Users\user\Desktop\LtmV2sDcTK.exe "C:\Users\user\Desktop\LtmV2sDcTK.exe"
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5248 -s 1224

Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\LtmV2sDcTK.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: LtmV2sDcTK.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: LtmV2sDcTK.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: LtmV2sDcTK.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Code function: 0_2_0000006AD78FDF9B push eax; ret		0_2_0000006AD78FE1F7
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Code function: 0_2_0000006AD78FE179 push eax; ret		0_2_0000006AD78FE1F7

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025455013000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025455013000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\LtmV2sDcTK.exe

Code function: 0_2_00007FF7026E67E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7026E67E8

Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Code function: 0_2_00007FF7026E6990 SetUnhandledExceptionFilter,		0_2_00007FF7026E6990
Source: C:\Users\user\Desktop\LtmV2sDcTK.exe	Code function: 0_2_00007FF7026E67E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF7026E67E8

Source: C:\Users\user\Desktop\LtmV2sDcTK.exe

Code function: 0_2_00007FF7026E6A00 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7026E6A00

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match

File source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY

Yara detected Metasploit Payload

Source: Yara match

File source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LtmV2sDcTK.exe	61%	ReversingLabs	Win64.Backdoor.MeterpreterReverseShell
LtmV2sDcTK.exe	38%	Virustotal		Browse
LtmV2sDcTK.exe	100%	Avira	TR/AD.MeterpreterSC.cupky

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://code.jquery.com/	0%	Avira URL Cloud	safe
http://code.jquery.com/G	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/dll	0%	Avira URL Cloud	safe
http://116.198.231.169:63222/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.js=	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jskies	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jszjk1	0%	Avira URL Cloud	safe
http://116.198.231.169:63222/jquery-3.3.2.slim.min.js	0%	Virustotal		Browse
http://code.jquery.com/G	0%	Virustotal		Browse
http://code.jquery.com/B	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsRjC1	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsingsm	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/dll	0%	Virustotal		Browse
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jskies	0%	Virustotal		Browse
https://116.198.231.169:63222/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
http://code.jquery.com/	1%	Virustotal		Browse
https://116.198.231.169:63222/	0%	Avira URL Cloud	safe
http://code.jquery.com/B	0%	Virustotal		Browse
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsock	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.js	0%	Virustotal		Browse
http://code.jquery.com/q	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/al	0%	Avira URL Cloud	safe
https://116.198.231.169/	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/bV=1	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsU	0%	Avira URL Cloud	safe
http://code.jquery.com/q	1%	Virustotal		Browse
https://116.198.231.169:63222/AppData	0%	Avira URL Cloud	safe
https://116.198.231.169/	0%	Virustotal		Browse
http://116.198.231.169/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://116.198.231.169:63222/jquery-3.3.2.slim.min.js	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://116.198.231.169/jquery-3.3.2.slim.min.js	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://code.jquery.com/	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000002.2948541073.000002545502A000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000003.2465339472.000002545502A000.00000004.00000020.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://code.jquery.com/G	LtmV2sDcTK.exe, 00000000.00000003.2424244410.000002545502A000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000003.2445008563.000002545502A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/dll	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.js=	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jskies	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jszjk1	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454F9C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/B	LtmV2sDcTK.exe, 00000000.00000003.2424244410.000002545502A000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000003.2445008563.000002545502A000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000002.2948541073.000002545502A000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000003.2465339472.000002545502A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsRjC1	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454F9C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsingsm	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.js	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454F9C000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp, LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025455013000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsock	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/q	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/al	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169/	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025455013000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/bV=1	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsU	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/AppData	LtmV2sDcTK.exe, 00000000.00000002.2948541073.0000025454FEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.198.231.169	unknown	China		137699	CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1508522
Start date and time:	2024-09-10 10:57:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LtmV2sDcTK.exe renamed because original name is a hash value
Original Sample Name:	98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf.exe
Detection:	MAL
Classification:	mal96.troj.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 4 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
116.198.231.169	TEiot52yrz.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	2PSj0qX4W6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	QT2hJT3Syn.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian	TEiot52yrz.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	2PSj0qX4W6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	QT2hJT3Syn.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	gOEF4WOJ3c.elf	Get hash	malicious	Unknown	Browse	116.198.238.210

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LtmV2sDcTK.exe_6f432411f7e3795a6924a77011d972658b73a_7f8e8508_70d54e1a-387b-4360-89c4-3cad73c540cd\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9233161409876522
Encrypted:	false
SSDEEP:	192:8FKoU67tBb0I3Dkjc4bzuiFr9Z24lO8M:5oUmtBoI3DkjtzuiFr9Y4lO8M
MD5:	0C0A143F19A276BFC700440C785E9090
SHA1:	8C82C1812611131B082F248E9FD102869A40543B
SHA-256:	A86BCBE59FC9C0BF37F3C88B9EFB244EB7ADB5F7AF9AF42ABBFBF9DE2AD8744C
SHA-512:	EF20A0D390745F2257DA2B2F6326879EAF3EAA9C4BAF6594D24300777C857172D5394A68832873FD178FECD6E0B64F838E8DB0A5385591C454CE45231F0759E7
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.4.3.2.3.6.0.2.2.1.0.2.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.4.3.2.3.6.0.8.4.6.0.1.6.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.0.d.5.4.e.1.a.-.3.8.7.b.-.4.3.6.0.-.8.9.c.4.-.3.c.a.d.7.3.c.5.4.0.c.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.2.4.1.4.a.9.1.-.e.d.9.b.-.4.3.9.8.-.a.4.6.3.-.c.c.3.8.6.4.9.0.f.1.1.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.L.t.m.V.2.s.D.c.T.K...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.8.0.-.0.0.0.1.-.0.0.1.4.-.1.4.f.0.-.5.3.a.0.5.f.0.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.d.b.1.0.0.a.e.f.a.6.6.3.5.5.a.8.c.1.0.3.6.b.f.8.4.f.1.5.0.5.3.0.0.0.0.f.f.f.f.!.0.0.0.0.8.7.f.9.c.8.3.7.7.d.6.4.3.c.b.2.d.7.4.9.d.e.b.f.c.9.9.9.e.0.0.2.2.0.1.c.a.2.9.2.!.L.t.m.V.2.s.D.c.T.K...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.6././.2.1.:.1.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB6.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Sep 10 08:59:20 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	143704
Entropy (8bit):	1.4714481695330766
Encrypted:	false
SSDEEP:	192:CWt+Vl1NyrpROIoI5uLZUaUyYnfTFCtMvmq5OIKjTybrmem62BCBkJ:Tg/LYa9I5uLZrUotFqLIyXmem62BCBkJ
MD5:	696C1EAEF8708175B289A73499A1D4B3
SHA1:	47769ECDA15AC2213BE734D7335CF3A2AF277C90
SHA-256:	B389C9B9C4FD8ED5AA5ABAB7C506E06781C5E5ABED96AC939BEE33BD4EBE7051
SHA-512:	00AF3B92B0E9E3C30EDC4C781FC5B534C5173CE24E40C7C4A393A1F6CE92C04537BA5673E9B28BCCFCC3C83AF43B530290252E55B45603FC19A4F763117D88ED
Malicious:	false
Yara Hits:	Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB6.tmp.dmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB6.tmp.dmp, Author: unknown
Reputation:	low
Preview:	MDMP..a..... .......h..f........................................,S..........T.......8...........T...........x...............P...........<...............................................................................eJ..............Lw......................T...........>..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50E0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8900
Entropy (8bit):	3.7047795306837856
Encrypted:	false
SSDEEP:	192:R6l7wVeJQoG6YEIdl6nGHggmfnzkpDB89bAlkf8Igm:R6lXJfG6YEilCGHggmfznAWfT
MD5:	DE8EA59075785D776D383F68D1DE7231
SHA1:	89AC50E985F087C20F95096BC7B8409E938C0715
SHA-256:	F42F8DF5D428128F063DE724332794A5C51CA59E04FA4F39C3DCA7ECCF125506
SHA-512:	F24F8F406C330A1FD96DE9960F68486C5293809711E7B3EC87C2768AE5889CB3AE44F5A4DF0632F3629C176D23DAF0DA759FF7734944A724DAF45731E23C894E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER510F.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4800
Entropy (8bit):	4.486086466402742
Encrypted:	false
SSDEEP:	48:cvIwWl8zsJJg771I9pWWpW8VYrgYm8M4JujO1FByq8vNjO91PJsf4d:uIjfbI7i37V0Jg6WFe1BA4d
MD5:	5DACC6E91F8266AC6088CD6B7D368EE2
SHA1:	6FABA853FC31B088479EBD170ADDF9C130166099
SHA-256:	9F3795127CC65A5A377D2CDFC879AFD155B6A0724B011BEE2F3852EE55D509A6
SHA-512:	14CBC8A77574914EE70FC6FD17B3BE9386C8B59A4E03402C716FBDA8DFB53AC3FED9D376981FD6C98FC0F6A85B90AD6699D269D0417E00EE8BD9617FD7F806E6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="493922" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421597657148385
Encrypted:	false
SSDEEP:	6144:FSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNP0uhiTw:MvloTMW+EZMM6DFyd03w
MD5:	1EFE553133551F86FC2914A7FF675B65
SHA1:	4D7E96ED1A48FC59DC9643CC8F522883C5FE578B
SHA-256:	2A63E9FDCCEC3665A94E87044C9F743C2AE0F7479C00E0942D085A92F64AD63E
SHA-512:	E28881B001216EA53DC983041B086EC67A74F172A690BCF0BD0DF0AE97245B5DE18F773E61145EF7D89E2A8BDFDAEEFE1B5DEB0CE32BB6C42E5CAE70E3FC8EC9
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmv.0._................................................................................................................................................................................................................................................................................................................................................x'.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.5292035095368535
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LtmV2sDcTK.exe
File size:	51'712 bytes
MD5:	2e7c2fa8c75a99967dbf0d6ccf82d0df
SHA1:	87f9c8377d643cb2d749debfc999e002201ca292
SHA256:	98ceec87cb638db932e818b0e0b72e4de6870e6aba08b172faefcc97808685cf
SHA512:	e599ff443deb6481efe2da010f04583c65cae9059e64438856c08bb7b505d035e566b5d9b4931439f281f01716453bc9e75d72c0654180c20bd1f77c351187b5
SSDEEP:	1536:3jhX4gMZu8wcFHMESJ7qF3CNES4oqiedNRU:3jh8Zu8wcFHMESJ7q3Czgz
TLSH:	9133294BDE6216F5E4B7C23881A2B23BF9F139E64A30E70B97D551071B22770A43EB44
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...)..A)..A)..A .EA%..A...@..A...@ ..A...@0..A...@/..Ab..@,..A)..Af..A:..@..A:..@(..ARich)..A................PE..d...Cwuf...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140006484
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66757743 [Fri Jun 21 12:51:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6603ea65ff245fea1598db6fadad400d

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FF908EC50F8h
dec eax
add esp, 28h
jmp 00007FF908EC49F7h
int3
int3
jmp 00007FF908EC5332h
int3
int3
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [00000EE4h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00000EC9h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FF908EC4B57h
dec eax
lea edx, dword ptr [0000578Bh]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FF908EC524Eh
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FF908EC24CFh
dec eax
lea edx, dword ptr [0000583Bh]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FF908EC522Eh
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push ebp
push edi
inc ecx
push esi
dec eax
mov ebp, esp
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc esp
mov edx, edx
inc ecx
xor edx, 49656E69h
inc ecx
xor eax, 6C65746Eh
inc esp
mov ecx, ebx
inc esp
mov esi, eax
xor ecx, ecx
mov eax, 00000001h
cpuid
inc ebp
or edx, eax
mov dword ptr [ebp-10h], eax
inc ecx
xor ecx, 756E6547h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbd4c	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x5b8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf000	0x68	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb2d0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb190	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e52	0x6000	0540a54e1e41ee73500608066b82dfab	False	0.3524576822916667	data	5.580721179770209	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x5a60	0x5c00	8df635e0647fdbe2e0f433bf71434d14	False	0.6346382472826086	data	7.130658907572664	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xd000	0x200	0x200	48c645ee3ae018ed638eac40ff31ae84	False	0.26171875	DOS executable (block device driver \377\377\377\377\377\377)	2.221799086773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe000	0x5b8	0x600	40c05ff07060f4e120676ec8539e1384	False	0.4596354166666667	data	4.033669625654416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf000	0x68	0x200	93219434cb3d69672f2d4070d710cb32	False	0.203125	data	1.2434609234962133	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, GetModuleHandleW, IsProcessorFeaturePresent, LoadLibraryA, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, InitializeSListHead, VirtualProtect
MSVCP140.dll	?flags@ios_base@std@@QEBAHXZ, ?good@ios_base@std@@QEBA_NXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?width@ios_base@std@@QEAA_J_J@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ, ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ, ?uncaught_exception@std@@YA_NXZ, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?_Xlength_error@std@@YAXPEBD@Z, ?width@ios_base@std@@QEBA_JXZ
CRYPT32.dll	CertEnumSystemStore
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__std_exception_copy, __current_exception_context, memcpy, __current_exception, _CxxThrowException, __C_specific_handler, memset, memchr, __std_exception_destroy
api-ms-win-crt-string-l1-1-0.dll	isalnum, strlen
api-ms-win-crt-runtime-l1-1-0.dll	__p___argc, __p___argv, _c_exit, _register_thread_local_exe_atexit_callback, _exit, exit, _invalid_parameter_noinfo_noreturn, _initterm_e, terminate, _configure_narrow_argv, _initterm, _get_initial_narrow_environment, _initialize_onexit_table, _initialize_narrow_environment, _set_app_type, _seh_filter_exe, _cexit, _crt_atexit, _register_onexit_function
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, _set_new_mode, free, malloc
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-10T10:58:41.962223+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49704	116.198.231.169	63222	TCP
2024-09-10T10:58:46.106093+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49707	116.198.231.169	63222	TCP
2024-09-10T10:58:50.183653+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49710	116.198.231.169	63222	TCP
2024-09-10T10:58:54.361605+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49713	116.198.231.169	63222	TCP
2024-09-10T10:58:58.813542+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49717	116.198.231.169	63222	TCP
2024-09-10T10:59:02.907545+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49724	116.198.231.169	63222	TCP
2024-09-10T10:59:06.958588+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49727	116.198.231.169	63222	TCP
2024-09-10T10:59:10.992677+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49730	116.198.231.169	63222	TCP
2024-09-10T10:59:14.951779+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49733	116.198.231.169	63222	TCP
2024-09-10T10:59:19.061173+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49736	116.198.231.169	63222	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 10, 2024 10:58:39.893266916 CEST	49704	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:39.898262978 CEST	63222	49704	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:39.898394108 CEST	49704	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:39.975496054 CEST	49704	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:39.980664968 CEST	63222	49704	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:41.961920023 CEST	63222	49704	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:41.962223053 CEST	49704	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:41.962223053 CEST	49704	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:41.962817907 CEST	49705	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:41.967210054 CEST	63222	49704	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:41.967644930 CEST	63222	49705	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:41.967729092 CEST	49705	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:41.968091965 CEST	49705	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:41.972889900 CEST	63222	49705	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:44.072877884 CEST	63222	49705	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:44.073100090 CEST	49705	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:44.073764086 CEST	49706	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:44.073764086 CEST	49705	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:44.078682899 CEST	63222	49706	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:44.078699112 CEST	63222	49705	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:44.078798056 CEST	49706	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:44.079011917 CEST	49706	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:44.080475092 CEST	49707	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:44.084146023 CEST	63222	49706	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:44.084223032 CEST	49706	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:44.085302114 CEST	63222	49707	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:44.085374117 CEST	49707	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:44.085659027 CEST	49707	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:44.090579987 CEST	63222	49707	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:46.106008053 CEST	63222	49707	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:46.106092930 CEST	49707	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:46.106182098 CEST	49707	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:46.106770992 CEST	49708	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:46.110913038 CEST	63222	49707	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:46.111692905 CEST	63222	49708	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:46.111774921 CEST	49708	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:46.112010002 CEST	49708	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:46.116822958 CEST	63222	49708	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:48.158993006 CEST	63222	49708	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:48.159178972 CEST	49708	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:48.159373045 CEST	49708	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:48.160105944 CEST	49709	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:48.164285898 CEST	63222	49708	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:48.164977074 CEST	63222	49709	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:48.165098906 CEST	49709	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:48.165431976 CEST	49709	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:48.167073965 CEST	49710	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:48.170326948 CEST	63222	49709	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:48.170432091 CEST	49709	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:48.171883106 CEST	63222	49710	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:48.171998024 CEST	49710	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:48.172544956 CEST	49710	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:48.177508116 CEST	63222	49710	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:50.182658911 CEST	63222	49710	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:50.183653116 CEST	49710	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:50.183653116 CEST	49711	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:50.183653116 CEST	49710	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:50.188594103 CEST	63222	49710	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:50.188610077 CEST	63222	49711	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:50.188771963 CEST	49711	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:50.189131021 CEST	49711	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:50.194041967 CEST	63222	49711	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:52.292670965 CEST	63222	49711	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:52.293061018 CEST	49711	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:52.293119907 CEST	49711	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:52.293889999 CEST	49712	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:52.298913002 CEST	63222	49711	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:52.299671888 CEST	63222	49712	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:52.299776077 CEST	49712	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:52.299956083 CEST	49712	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:52.305053949 CEST	63222	49712	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:52.305140972 CEST	49712	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:52.305641890 CEST	49713	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:52.310517073 CEST	63222	49713	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:52.310681105 CEST	49713	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:52.311023951 CEST	49713	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:52.316530943 CEST	63222	49713	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:54.361540079 CEST	63222	49713	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:54.361604929 CEST	49713	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:54.361737013 CEST	49713	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:54.362339973 CEST	49714	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:54.670007944 CEST	49713	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:54.685019016 CEST	63222	49713	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:54.685095072 CEST	49713	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:54.692121029 CEST	63222	49713	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:54.692164898 CEST	63222	49714	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:54.692229986 CEST	49714	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:54.692681074 CEST	49714	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:54.692800999 CEST	63222	49713	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:54.692850113 CEST	49713	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:54.697467089 CEST	63222	49714	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:56.715267897 CEST	63222	49714	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:56.715329885 CEST	49714	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:56.715769053 CEST	49714	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:56.716373920 CEST	49716	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:56.720611095 CEST	63222	49714	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:56.721267939 CEST	63222	49716	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:56.721342087 CEST	49716	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:56.721452951 CEST	49716	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:56.722903967 CEST	49717	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:56.726713896 CEST	63222	49716	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:56.726764917 CEST	49716	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:56.727761030 CEST	63222	49717	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:56.727821112 CEST	49717	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:56.728138924 CEST	49717	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:56.736335993 CEST	63222	49717	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:58.813474894 CEST	63222	49717	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:58.813541889 CEST	49717	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:58.813642025 CEST	49717	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:58.814224958 CEST	49721	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:58.818527937 CEST	63222	49717	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:58.819283962 CEST	63222	49721	116.198.231.169	192.168.2.5
Sep 10, 2024 10:58:58.819360971 CEST	49721	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:58.819653034 CEST	49721	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:58:58.824683905 CEST	63222	49721	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:00.867486954 CEST	63222	49721	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:00.867629051 CEST	49721	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:00.867824078 CEST	49721	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:00.868563890 CEST	49723	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:00.873426914 CEST	63222	49721	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:00.873439074 CEST	63222	49723	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:00.873557091 CEST	49723	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:00.873682022 CEST	49723	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:00.875072956 CEST	49724	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:00.879458904 CEST	63222	49723	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:00.879528999 CEST	49723	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:00.882509947 CEST	63222	49724	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:00.882591963 CEST	49724	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:00.882922888 CEST	49724	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:00.889718056 CEST	63222	49724	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:02.907417059 CEST	63222	49724	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:02.907545090 CEST	49724	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:02.907744884 CEST	49724	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:02.908379078 CEST	49725	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:02.912579060 CEST	63222	49724	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:02.913199902 CEST	63222	49725	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:02.913300037 CEST	49725	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:02.913506985 CEST	49725	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:02.918328047 CEST	63222	49725	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:04.909683943 CEST	63222	49725	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:04.909806013 CEST	49725	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:04.910084009 CEST	49725	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:04.910697937 CEST	49726	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:04.914906025 CEST	63222	49725	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:04.915515900 CEST	63222	49726	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:04.915589094 CEST	49726	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:04.915679932 CEST	49726	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:04.918570042 CEST	49727	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:04.920722008 CEST	63222	49726	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:04.920773029 CEST	49726	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:04.923475981 CEST	63222	49727	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:04.923547029 CEST	49727	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:04.923788071 CEST	49727	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:04.928599119 CEST	63222	49727	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:06.958374977 CEST	63222	49727	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:06.958587885 CEST	49727	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:06.958648920 CEST	49727	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:06.959299088 CEST	49728	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:06.963531017 CEST	63222	49727	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:06.964205027 CEST	63222	49728	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:06.964272022 CEST	49728	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:06.964526892 CEST	49728	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:06.969321012 CEST	63222	49728	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:08.961380005 CEST	63222	49728	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:08.961503029 CEST	49728	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:08.961781025 CEST	49728	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:08.962366104 CEST	49729	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:08.967271090 CEST	63222	49728	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:08.967988968 CEST	63222	49729	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:08.968084097 CEST	49729	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:08.968182087 CEST	49729	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:08.969619989 CEST	49730	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:08.974472046 CEST	63222	49729	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:08.974565029 CEST	49729	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:08.975874901 CEST	63222	49730	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:08.975949049 CEST	49730	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:08.976239920 CEST	49730	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:08.981441975 CEST	63222	49730	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:10.992494106 CEST	63222	49730	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:10.992676973 CEST	49730	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:10.993087053 CEST	49730	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:10.997227907 CEST	49731	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:10.997951984 CEST	63222	49730	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:11.002110004 CEST	63222	49731	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:11.002176046 CEST	49731	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:11.002418041 CEST	49731	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:11.007369041 CEST	63222	49731	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:12.970555067 CEST	63222	49731	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:12.970629930 CEST	49731	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:12.970714092 CEST	49731	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:12.975876093 CEST	63222	49731	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:12.977377892 CEST	49732	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:12.982539892 CEST	63222	49732	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:12.982620001 CEST	49732	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:12.982708931 CEST	49732	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:12.984006882 CEST	49733	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:12.988080025 CEST	63222	49732	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:12.988177061 CEST	49732	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:12.989734888 CEST	63222	49733	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:12.989824057 CEST	49733	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:12.990050077 CEST	49733	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:12.994905949 CEST	63222	49733	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:14.951637030 CEST	63222	49733	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:14.951778889 CEST	49733	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:14.951828003 CEST	49733	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:14.957048893 CEST	49734	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:14.958087921 CEST	63222	49733	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:14.961942911 CEST	63222	49734	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:14.962049007 CEST	49734	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:14.962423086 CEST	49734	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:14.968020916 CEST	63222	49734	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:17.024293900 CEST	63222	49734	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:17.024421930 CEST	49734	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:17.024590015 CEST	49734	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:17.029361963 CEST	63222	49734	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:17.030442953 CEST	49735	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:17.035249949 CEST	63222	49735	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:17.035360098 CEST	49735	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:17.035485983 CEST	49735	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:17.038677931 CEST	49736	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:17.040522099 CEST	63222	49735	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:17.040594101 CEST	49735	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:17.043596983 CEST	63222	49736	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:17.043690920 CEST	49736	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:17.044121981 CEST	49736	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:17.048911095 CEST	63222	49736	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:19.060976028 CEST	63222	49736	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:19.061172962 CEST	49736	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:19.061376095 CEST	49736	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:19.066173077 CEST	63222	49736	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:19.067217112 CEST	49737	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:19.072077036 CEST	63222	49737	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:19.072159052 CEST	49737	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:19.072633028 CEST	49737	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:19.077749968 CEST	63222	49737	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:21.054650068 CEST	63222	49737	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:21.054708958 CEST	49737	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:21.054806948 CEST	49737	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:21.055425882 CEST	49738	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:21.059786081 CEST	63222	49737	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:21.060333014 CEST	63222	49738	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:21.060394049 CEST	49738	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:21.060699940 CEST	49738	63222	192.168.2.5	116.198.231.169
Sep 10, 2024 10:59:21.066143036 CEST	63222	49738	116.198.231.169	192.168.2.5
Sep 10, 2024 10:59:21.066201925 CEST	49738	63222	192.168.2.5	116.198.231.169

Target ID:	0
Start time:	04:58:38
Start date:	10/09/2024
Path:	C:\Users\user\Desktop\LtmV2sDcTK.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\LtmV2sDcTK.exe"
Imagebase:	0x7ff7026e0000
File size:	51'712 bytes
MD5 hash:	2E7C2FA8C75A99967DBF0D6CCF82D0DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:59:20
Start date:	10/09/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5248 -s 1224
Imagebase:	0x7ff60cb40000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	1.6%
Signature Coverage:	5.5%
Total number of Nodes:	309
Total number of Limit Nodes:	1

Executed Functions

Function 0000006AD78FDF42 Relevance: 6.9, APIs: 2, Strings: 1, Instructions: 1633librarynetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000006AD78FDF5D
InternetOpenA.WININET(00000000,00000000), ref: 0000006AD78FDF75

Strings

wini, xrefs: 0000006AD78FDF46

Memory Dump Source

Source File: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, Offset: 0000006AD78FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad78fd000_LtmV2sDcTK.jbxd

Yara matches

Similarity

API ID: InternetLibraryLoadOpen
String ID: wini
API String ID: 2559873147-1606035523
Opcode ID: 0fd50fba13a0cf412481536cc214a373d68565132ac851142699336e80ce3788
Instruction ID: 8d602d621b4695f1b2c0b64586e9c26eae9419304fdd92d8552843cf4ed1c796
Opcode Fuzzy Hash: 0fd50fba13a0cf412481536cc214a373d68565132ac851142699336e80ce3788
Instruction Fuzzy Hash: 4D92B3314097D1AEEB669F34D055747BFA1FF4B714FA614EDC8C25E423C222A892CB92

Function 00007FF7026E57D0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 93
librarymemoryencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7026E5504: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7026E5583
Part of subcall function 00007FF7026E5504: memcpy.VCRUNTIME140 ref: 00007FF7026E5598
Part of subcall function 00007FF7026E5504: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7026E55D3
Part of subcall function 00007FF7026E5504: memcpy.VCRUNTIME140 ref: 00007FF7026E55E8

LoadLibraryA.KERNEL32 ref: 00007FF7026E590C
VirtualProtect.KERNELBASE ref: 00007FF7026E592F
CertEnumSystemStore.CRYPT32 ref: 00007FF7026E5947

Strings

fTk0IXs+RsZrY9epOUeq1oQ0l4RoVPjlVJoEuMX3zPeE+je8GdHrJUcxFZpepdr4SDRVKa6s7ouAvVNOqjbmDXauHJGPlOuvClVpjZvRyLdC2d6h5WF7twqC1kX9nIKWgL9KaawEYPrhgpcPJeSSnLatPbvLnYxgng2QCJQ8DmxkwRBosnzlWeW39pnWOJcwZvMht1Ue7ys35aku9WPa2jr1RTE8qRhrprEAHTM+xpPpcOmcTSt4aUDyEbOtWv6EV/1G, xrefs: 00007FF7026E57F0
kernel32.dll, xrefs: 00007FF7026E5905
W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu, xrefs: 00007FF7026E580C
W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu, xrefs: 00007FF7026E5825

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorkmemcpy$CertEnumLibraryLoadProtectStoreSystemVirtual
String ID: W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu$W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu$fTk0IXs+RsZrY9epOUeq1oQ0l4RoVPjlVJoEuMX3zPeE+je8GdHrJUcxFZpepdr4SDRVKa6s7ouAvVNOqjbmDXauHJGPlOuvClVpjZvRyLdC2d6h5WF7twqC1kX9nIKWgL9KaawEYPrhgpcPJeSSnLatPbvLnYxgng2QCJQ8DmxkwRBosnzlWeW39pnWOJcwZvMht1Ue7ys35aku9WPa2jr1RTE8qRhrprEAHTM+xpPpcOmcTSt4aUDyEbOtWv6EV/1G$kernel32.dll
API String ID: 1274391132-1474288648
Opcode ID: 8bd6efedfb835c6262895cf33987eb0a2031c08ad2c6fa2203a3ec108a2f1f03
Instruction ID: 9ceb67cb91e9079003d0024157079b23619e3e3ce961b4809c42b418532b2a91
Opcode Fuzzy Hash: 8bd6efedfb835c6262895cf33987eb0a2031c08ad2c6fa2203a3ec108a2f1f03
Instruction Fuzzy Hash: 444107626085C5A5DE20DB50E8543EAAB62FFD4388FC00032F68D83F69EF6DD545CB10

Function 00007FF7026E6308 Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7026E6331
__scrt_release_startup_lock.LIBCMT ref: 00007FF7026E639F
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7026E63ED
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7026E63F2
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7026E63FA
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7026E6402
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7026E6424
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7026E647E

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: 795f68f39069cbc62f03802973729ce4b798ecc3c9951e2823eb01123459fcb6
Instruction ID: d741e5f3a94c63610276c16208300a1599662bb226d457f879e4148df4d71b57
Opcode Fuzzy Hash: 795f68f39069cbc62f03802973729ce4b798ecc3c9951e2823eb01123459fcb6
Instruction Fuzzy Hash: A8313B23A08142A1EE54BB24DD123B99A9BAF6578CFC45434FA4D07AD7DFEEA404C630

Function 0000006AD78FDF9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpOpenRequestA.WININET(00000000,00000000,84C03200,00000000), ref: 0000006AD78FDFB6

Strings

U.;, xrefs: 0000006AD78FDFB1

Memory Dump Source

Source File: 00000000.00000002.2948402496.0000006AD78FD000.00000040.00000010.00020000.00000000.sdmp, Offset: 0000006AD78FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ad78fd000_LtmV2sDcTK.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: U.;
API String ID: 1984915467-4213443877
Opcode ID: ab09341529980e95ac1e803047b3985bc20a26ea9b837d55d995e7e224907264
Instruction ID: 44305753174c8bd9196cf4d3bba622a666c6154d390c1d09de147cadd62bfebf
Opcode Fuzzy Hash: ab09341529980e95ac1e803047b3985bc20a26ea9b837d55d995e7e224907264
Instruction Fuzzy Hash: C7118BA034890D1BF62C919E7C6A73A61CBD3D9726F24812FB50FD33DADC58CC92442A

Non-executed Functions

Function 00007FF7026E67E8 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7026E6804
memset.VCRUNTIME140 ref: 00007FF7026E6828
RtlCaptureContext.KERNEL32 ref: 00007FF7026E6831
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7026E684B
RtlVirtualUnwind.KERNEL32 ref: 00007FF7026E688C
memset.VCRUNTIME140 ref: 00007FF7026E68BF
IsDebuggerPresent.KERNEL32 ref: 00007FF7026E68E0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7026E68FD
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7026E6908

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: e24a973d2b331336046820436802f9fa805a275ff50cf57bd253def1d79dafc7
Instruction ID: 165c4d4515767787e93fd8da42e452d47632ec7b406dd1d4b695d76ff97ecb49
Opcode Fuzzy Hash: e24a973d2b331336046820436802f9fa805a275ff50cf57bd253def1d79dafc7
Instruction Fuzzy Hash: 18316E73608B8196EB60AF60E8503EDB765FB94748F84403AEA4D47F94DF79D248C720

Function 00007FF7026E2E90 Relevance: 6.6, APIs: 2, Strings: 2, Instructions: 581
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FF7026E2EF2
, xrefs: 00007FF7026E2ECF

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: ce9985986e7a16e9417682335ff6eac846c42425677f4b87566591c41d316c4d
Instruction ID: eff2896412e7869d13bd6cc451c35e579a325a3c45e4e6ea64a2724e9833a999
Opcode Fuzzy Hash: ce9985986e7a16e9417682335ff6eac846c42425677f4b87566591c41d316c4d
Instruction Fuzzy Hash: D152EC73609A81CADB74CB19E88076ABBA1F7C8749F444236E68E83B58DB7DD551CF00

Function 00007FF7026E6A00 Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7026E6A2C
GetCurrentThreadId.KERNEL32 ref: 00007FF7026E6A3A
GetCurrentProcessId.KERNEL32 ref: 00007FF7026E6A46
QueryPerformanceCounter.KERNEL32 ref: 00007FF7026E6A56

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 4f0ed3d7c44258c2662e79e85a0674993ec415bbcf6ffa42194b6fbc29eb623c
Instruction ID: 483f9936a87a96696d5a3d7080d295c4ec23efad519407356c98837bb1fc7268
Opcode Fuzzy Hash: 4f0ed3d7c44258c2662e79e85a0674993ec415bbcf6ffa42194b6fbc29eb623c
Instruction Fuzzy Hash: 36113A66B14B419AEF00DF60EC442A877A4FB58758F840E31EA6D46BA4DFB8D159C350

Function 00007FF7026E1154 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27dbf3ec0a422b263cffaaebb98af3aa1fd7cf269184044aa5ce842c9682b3e
Instruction ID: 756b7ae599ba62c008f6499554e81711169cb41f6c8ea177bc1f4386e7a90f42
Opcode Fuzzy Hash: b27dbf3ec0a422b263cffaaebb98af3aa1fd7cf269184044aa5ce842c9682b3e
Instruction Fuzzy Hash: F7422F73609A859ADB04CB1CE89063AFBA1F7D8790F444526E79EC3BA9CA7CD551CF00

Function 00007FF7026E19E0 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf41e5f2b4326b7b92995bf4544de512335b391d8981c46ffd877e208d0ac12
Instruction ID: 24a548483aa565ef2bcb34df21a39e968a92e962bc750e4ba08e9d063dec3a06
Opcode Fuzzy Hash: 8cf41e5f2b4326b7b92995bf4544de512335b391d8981c46ffd877e208d0ac12
Instruction Fuzzy Hash: 7E421C73608A859ADB45CB1CE89063AFBE1F7C8780F444526E69EC3B69DA7CD551CF00

Function 00007FF7026E1423 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cb073c722dbeb7a1613e414c717d1bbe413e1924b949a2fed674e60258cf06
Instruction ID: c4de695cfc99f1077d3551f82359964c12d17356ac50f75ff37a5554c1d1c686
Opcode Fuzzy Hash: e1cb073c722dbeb7a1613e414c717d1bbe413e1924b949a2fed674e60258cf06
Instruction Fuzzy Hash: 9E6160B26189829BDB14DF08E89067AB7A2FFCC744F448635E34A87A59CB7DE550CF00

Function 00007FF7026E1CB2 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade8b643f1c0eeaaf7db3813646950adb663fa17e422860113df2ace2981a793
Instruction ID: f83794193694dae8bb948472ed44d2342f0ac7731a2c300bc2594833195bece6
Opcode Fuzzy Hash: ade8b643f1c0eeaaf7db3813646950adb663fa17e422860113df2ace2981a793
Instruction Fuzzy Hash: CF6160B26189819BDB14CF08E89067AB7A2FFCC744F448536E34A87A58CB3DE550CF00

Function 00007FF7026E6990 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1efa7e2d928306cb2ca00731a208084a2c5edd186dd86c1f002025f8979efa9c
Instruction ID: df4ea835d8740043b947f12a876470433097b5341502c924da3cb9df8e0cfa39
Opcode Fuzzy Hash: 1efa7e2d928306cb2ca00731a208084a2c5edd186dd86c1f002025f8979efa9c
Instruction Fuzzy Hash: 2FA00162949842E4EE49AB00EC50020AA66AF70309BC01431E00D418A0AFAEA445D221

Function 00007FF7026E59BC Relevance: 21.2, APIs: 14, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7026E4A3C: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00007FF7026E4556,?,?,?,?,?,?,00007FF7026E1017), ref: 00007FF7026E4A4A

?width@ios_base@std@@QEBA_JXZ.MSVCP140(?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5A04
?width@ios_base@std@@QEBA_JXZ.MSVCP140(?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5A2F
?width@ios_base@std@@QEBA_JXZ.MSVCP140(?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5A5C
?flags@ios_base@std@@QEBAHXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5AD5
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5B24
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5B4B
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5B5A
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5BB4
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5BCA
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5C32
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5C59
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5C68
?width@ios_base@std@@QEAA_J_J@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5CBD
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7026E5704), ref: 00007FF7026E5CED

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?width@ios_base@std@@$?rdbuf@?$basic_ios@D@std@@@2@V?$basic_streambuf@$?fill@?$basic_ios@?sputc@?$basic_streambuf@$?flags@ios_base@std@@?setstate@?$basic_ios@?sputn@?$basic_streambuf@strlen
String ID:
API String ID: 207065933-0
Opcode ID: 9a543b72adef7ad1c54ef009d41528a2a851eb801f28244e436a9c4c31cf3d2f
Instruction ID: 517b75039dbf1c43d4e1b85126ee5b720a16c3e834456e67579ed1fa098c4a9b
Opcode Fuzzy Hash: 9a543b72adef7ad1c54ef009d41528a2a851eb801f28244e436a9c4c31cf3d2f
Instruction Fuzzy Hash: F1910F73608B8596DE60DB15E894369FBA1FF88B89F808035EA8E87B54DF7DD004CB10

Function 00007FF7026E5504 Relevance: 9.1, APIs: 6, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7026E5583
memcpy.VCRUNTIME140 ref: 00007FF7026E5598
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7026E55D3
memcpy.VCRUNTIME140 ref: 00007FF7026E55E8
memset.VCRUNTIME140 ref: 00007FF7026E56EB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF7026E570E

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredV01@Workmemcpy$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@@memset
String ID:
API String ID: 2816322446-0
Opcode ID: da4bcb04198c5e8b51ca7315bf35769bb5109326478fd0f2e9130ee28da45189
Instruction ID: 0d11174c2edb3568dc43789fb87d0b7ac2daa58c21b015ad144c253fda98ddf5
Opcode Fuzzy Hash: da4bcb04198c5e8b51ca7315bf35769bb5109326478fd0f2e9130ee28da45189
Instruction Fuzzy Hash: 63711C6261CAC195DA50EB15F8903AEFB61FBC5784F901026FA8E83B69DF7DD444CB10

Function 00007FF7026E5DCC Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7026E5EFC: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140(?,?,?,?,?,?,00007FF7026E5DE9), ref: 00007FF7026E5F3E

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF7026E5E04
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF7026E5E36

Memory Dump Source

Source File: 00000000.00000002.2948743654.00007FF7026E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7026E0000, based on PE: true

Associated: 00000000.00000002.2948732057.00007FF7026E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948755896.00007FF7026E7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948768480.00007FF7026ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2948780362.00007FF7026EE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7026e0000_LtmV2sDcTK.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@2@D@std@@@std@@$?good@ios_base@std@@?rdbuf@?$basic_ios@?tie@?$basic_ios@V?$basic_ostream@V?$basic_streambuf@
String ID:
API String ID: 3792166412-0
Opcode ID: 13b0947ac47d77500c650e49bf78466621c48817c9b605b7b586476316c5a0b5
Instruction ID: 285355e6f6d7308dad47cfe0ef032fb45aa014da0a4fbbfddd3f40f4f80649f8
Opcode Fuzzy Hash: 13b0947ac47d77500c650e49bf78466621c48817c9b605b7b586476316c5a0b5
Instruction Fuzzy Hash: E321BE2660DB8591DE10EB19E894229ABB1FBC9BC8F944025EF8E43B64DF7ED454C710

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LtmV2sDcTK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Threatname: Metasploit

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LtmV2sDcTK.exe_6f432411f7e3795a6924a77011d972658b73a_7f8e8508_70d54e1a-387b-4360-89c4-3cad73c540cd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FB6.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50E0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER510F.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
LtmV2sDcTK.exe

Function 00007FF7026E57D0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 93
librarymemoryencryptionCOMMON

Function 00007FF7026E6308 Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Function 0000006AD78FDF9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99
networkCOMMON

Function 00007FF7026E67E8 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Function 00007FF7026E2E90 Relevance: 6.6, APIs: 2, Strings: 2, Instructions: 581
COMMON

Function 00007FF7026E6A00 Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMON

Function 00007FF7026E59BC Relevance: 21.2, APIs: 14, Instructions: 195
COMMON

Function 00007FF7026E5504 Relevance: 9.1, APIs: 6, Instructions: 148
COMMON

Function 00007FF7026E5DCC Relevance: 6.1, APIs: 4, Instructions: 53
COMMON