Edit tour

Windows Analysis Report
QT2hJT3Syn.exe

Overview

General Information

Sample name:	QT2hJT3Syn.exe renamed because original name is a hash value
Original sample name:	9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff.exe
Analysis ID:	1508523
MD5:	d19f3280851b5e9510a63fe7c80466ae
SHA1:	00e04653569a6d8244edff8765deec3d6ed9c15f
SHA256:	9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff
Tags:	116-198-231-169exe
Infos:

Detection

CobaltStrike, Metasploit

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected Metasploit Payload

C2 URLs / IPs found in malware configuration

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

One or more processes crash

PE file contains an invalid checksum

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

QT2hJT3Syn.exe (PID: 420 cmdline: "C:\Users\user\Desktop\QT2hJT3Syn.exe" MD5: D19F3280851B5E9510A63FE7C80466AE)

WerFault.exe (PID: 2016 cmdline: C:\Windows\system32\WerFault.exe -u -p 420 -s 1420 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"C2Server": "http://116.198.231.169:63222/jquery-3.7.2.min.js", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n"}

Threatname: Metasploit

{"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://www.microsoft.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://116.198.231.169/jquery-3.7.2.min.js"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2AA.tmp.dmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x9cab:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2AA.tmp.dmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x9d17:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x6e5:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x751:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T10:54:09.021829+0200	2028765	3	Unknown Traffic	192.168.2.9	49706	116.198.231.169	63222	TCP
2024-09-10T10:54:12.997124+0200	2028765	3	Unknown Traffic	192.168.2.9	49709	116.198.231.169	63222	TCP
2024-09-10T10:54:17.184645+0200	2028765	3	Unknown Traffic	192.168.2.9	49712	116.198.231.169	63222	TCP
2024-09-10T10:54:21.181917+0200	2028765	3	Unknown Traffic	192.168.2.9	49717	116.198.231.169	63222	TCP
2024-09-10T10:54:25.369978+0200	2028765	3	Unknown Traffic	192.168.2.9	49721	116.198.231.169	63222	TCP
2024-09-10T10:54:29.532212+0200	2028765	3	Unknown Traffic	192.168.2.9	49724	116.198.231.169	63222	TCP
2024-09-10T10:54:33.558180+0200	2028765	3	Unknown Traffic	192.168.2.9	49727	116.198.231.169	63222	TCP
2024-09-10T10:54:37.561102+0200	2028765	3	Unknown Traffic	192.168.2.9	49730	116.198.231.169	63222	TCP
2024-09-10T10:54:41.639898+0200	2028765	3	Unknown Traffic	192.168.2.9	49733	116.198.231.169	63222	TCP
2024-09-10T10:54:45.720763+0200	2028765	3	Unknown Traffic	192.168.2.9	49736	116.198.231.169	63222	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: QT2hJT3Syn.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp	Malware Configuration Extractor: CobaltStrike {"C2Server": "http://116.198.231.169:63222/jquery-3.7.2.min.js", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n"}
Source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp	Malware Configuration Extractor: Metasploit {"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://www.microsoft.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://116.198.231.169/jquery-3.7.2.min.js"}

Multi AV Scanner detection for submitted file

Source: QT2hJT3Syn.exe	ReversingLabs: Detection: 28%
Source: QT2hJT3Syn.exe	Virustotal: Detection: 31%			Perma Link

Source: QT2hJT3Syn.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://116.198.231.169:63222/jquery-3.7.2.min.js
Source: Malware configuration extractor	URLs: http://116.198.231.169/jquery-3.7.2.min.js

Source: global traffic

TCP traffic: 192.168.2.9:49706 -> 116.198.231.169:63222

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49712 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49727 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49706 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49717 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49724 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49730 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49709 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49736 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49733 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49721 -> 116.198.231.169:63222

Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169

Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169/
Source: QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169/$
Source: QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B9270C000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1770218937.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1790192849.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1688621736.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/
Source: QT2hJT3Syn.exe, 00000000.00000003.1608359854.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1628687831.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/=
Source: QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B926BC000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1749896413.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1770218937.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1790192849.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1688621736.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.7.2.min.js
Source: QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.7.2.min.jsUsK
Source: QT2hJT3Syn.exe, 00000000.00000003.1729412419.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1608359854.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1708837173.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1648594354.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1628687831.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1749896413.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1688621736.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.7.2.min.jsl
Source: QT2hJT3Syn.exe, 00000000.00000003.1729412419.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1608359854.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1708837173.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1648594354.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1628687831.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1688621736.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.7.2.min.jss
Source: QT2hJT3Syn.exe, 00000000.00000003.1729412419.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1608359854.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1708837173.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1648594354.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1628687831.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1749896413.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1770218937.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1790192849.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1688621736.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.7.2.min.jst
Source: QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B9270C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/rosoft
Source: QT2hJT3Syn.exe, 00000000.00000003.1729412419.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1749896413.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1770218937.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1790192849.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/w

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2AA.tmp.dmp, type: DROPPED	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2AA.tmp.dmp, type: DROPPED	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF6C3903EB0	0_2_00007FF6C3903EB0
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF6C3902DC0	0_2_00007FF6C3902DC0
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF6C39025E0	0_2_00007FF6C39025E0
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF6C3904360	0_2_00007FF6C3904360
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF6C3902A60	0_2_00007FF6C3902A60
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_0000000902FAE7E0	0_2_0000000902FAE7E0

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 420 -s 1420

Source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2AA.tmp.dmp, type: DROPPED	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2AA.tmp.dmp, type: DROPPED	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23

Source: classification engine

Classification label: mal92.troj.winEXE@2/5@0/1

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess420

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e7ede1d1-617a-4641-bd8f-97c37e993eca

Jump to behavior

Source: QT2hJT3Syn.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QT2hJT3Syn.exe	ReversingLabs: Detection: 28%
Source: QT2hJT3Syn.exe	Virustotal: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\QT2hJT3Syn.exe "C:\Users\user\Desktop\QT2hJT3Syn.exe"
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 420 -s 1420

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: QT2hJT3Syn.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: QT2hJT3Syn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: QT2hJT3Syn.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: QT2hJT3Syn.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: QT2hJT3Syn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: QT2hJT3Syn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: QT2hJT3Syn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: QT2hJT3Syn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: QT2hJT3Syn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: QT2hJT3Syn.exe

Static PE information: real checksum: 0x118b0 should be: 0x1df90

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_0000000902FAE7E0 push eax; ret		0_2_0000000902FAEA5B
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_0000000902FAE7FF push eax; ret		0_2_0000000902FAEA5B

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B9270C000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92746000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92746000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe

Code function: 0_2_00007FF6C3902038 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6C3902038

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF6C390221C SetUnhandledExceptionFilter,		0_2_00007FF6C390221C
Source: C:\Users\user\Desktop\QT2hJT3Syn.exe	Code function: 0_2_00007FF6C3902038 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF6C3902038

Source: C:\Users\user\Desktop\QT2hJT3Syn.exe

Code function: 0_2_00007FF6C390228C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6C390228C

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match

File source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY

Yara detected Metasploit Payload

Source: Yara match

File source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QT2hJT3Syn.exe	29%	ReversingLabs	Win64.Backdoor.Cobeacon
QT2hJT3Syn.exe	31%	Virustotal		Browse
QT2hJT3Syn.exe	100%	Avira	TR/AD.PatchedWinSwrort.uidrr

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://116.198.231.169:63222/jquery-3.7.2.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.7.2.min.jst	0%	Avira URL Cloud	safe
https://116.198.231.169/$	0%	Avira URL Cloud	safe
http://116.198.231.169:63222/jquery-3.7.2.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.7.2.min.jss	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/	0%	Avira URL Cloud	safe
http://116.198.231.169/jquery-3.7.2.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/=	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.7.2.min.jsl	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/rosoft	0%	Avira URL Cloud	safe
https://116.198.231.169/	0%	Avira URL Cloud	safe
http://116.198.231.169:63222/jquery-3.7.2.min.js	0%	Virustotal		Browse
https://116.198.231.169:63222/	0%	Virustotal		Browse
https://116.198.231.169:63222/w	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.7.2.min.jsUsK	0%	Avira URL Cloud	safe
https://116.198.231.169/	0%	Virustotal		Browse
https://116.198.231.169:63222/jquery-3.7.2.min.js	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://116.198.231.169:63222/jquery-3.7.2.min.js	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://116.198.231.169/jquery-3.7.2.min.js	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://116.198.231.169/$	QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92727000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.7.2.min.js	QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B926BC000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1749896413.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1770218937.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1790192849.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1688621736.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.7.2.min.jst	QT2hJT3Syn.exe, 00000000.00000003.1729412419.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1608359854.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1708837173.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1648594354.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1628687831.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1749896413.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1770218937.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1790192849.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1688621736.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.7.2.min.jss	QT2hJT3Syn.exe, 00000000.00000003.1729412419.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1608359854.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1708837173.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1648594354.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1628687831.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1688621736.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/	QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B9270C000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1770218937.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1790192849.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1688621736.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.7.dr	false	URL Reputation: safe	unknown
https://116.198.231.169:63222/=	QT2hJT3Syn.exe, 00000000.00000003.1608359854.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1628687831.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.7.2.min.jsl	QT2hJT3Syn.exe, 00000000.00000003.1729412419.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1608359854.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1708837173.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1648594354.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1628687831.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1749896413.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1688621736.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/rosoft	QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B9270C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169/	QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92727000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/w	QT2hJT3Syn.exe, 00000000.00000003.1729412419.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1749896413.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1770218937.0000018B92754000.00000004.00000020.00020000.00000000.sdmp, QT2hJT3Syn.exe, 00000000.00000003.1790192849.0000018B92754000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.7.2.min.jsUsK	QT2hJT3Syn.exe, 00000000.00000002.1862944008.0000018B92704000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.198.231.169	unknown	China		137699	CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1508523
Start date and time:	2024-09-10 10:53:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QT2hJT3Syn.exe renamed because original name is a hash value
Original Sample Name:	9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff.exe
Detection:	MAL
Classification:	mal92.troj.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:54:54	API Interceptor	1x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian	gOEF4WOJ3c.elf	Get hash	malicious	Unknown	Browse	116.198.238.210

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QT2hJT3Syn.exe_7f1a37c4c18389bc5a9768bc74304b343de52_f3ab7727_f8dad36d-3db4-4f4b-aff7-272943b6f4c3\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9838394803953416
Encrypted:	false
SSDEEP:	192:jsBSd0I3DLNOj/XWPzuiFrzZ24lO8TiG:wBSeI3DkjQzuiFrzY4lO8TL
MD5:	84C27111EF538A1E3F35704D2BB5949D
SHA1:	892A290423362FD04351F21B95CB811B3213D63A
SHA-256:	05F46313650C86B05FD475DB980C2B80F03B1C7E2A463952688E6C6E0FF7CE4C
SHA-512:	846EF2FFF6229FCD2FB6102DB3078E806495DB86CF1ECD82EDD9299B0DD28837B42FE34EB345F319BD1BAD6E722F65F3811FF7FCE6CD1818FA63D8432227B74B
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.4.3.2.0.8.7.5.5.6.1.8.5.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.4.3.2.0.8.7.9.7.8.0.6.8.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.8.d.a.d.3.6.d.-.3.d.b.4.-.4.f.4.b.-.a.f.f.7.-.2.7.2.9.4.3.b.6.f.4.c.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.d.e.d.4.6.a.3.-.b.d.3.5.-.4.5.b.e.-.8.8.d.4.-.c.5.e.b.4.9.b.7.2.2.b.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.Q.T.2.h.J.T.3.S.y.n...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.a.4.-.0.0.0.1.-.0.0.1.4.-.d.4.e.d.-.0.e.f.b.5.e.0.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.5.7.6.0.0.8.f.d.d.c.2.3.1.c.4.b.6.b.8.e.a.6.2.2.3.3.e.0.9.7.0.0.0.0.0.0.9.0.4.!.0.0.0.0.0.0.e.0.4.6.5.3.5.6.9.a.6.d.8.2.4.4.e.d.f.f.8.7.6.5.d.e.e.c.3.d.6.e.d.9.c.1.5.f.!.Q.T.2.h.J.T.3.S.y.n...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.8././.0.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2AA.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Sep 10 08:54:47 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	181100
Entropy (8bit):	1.3555617465497876
Encrypted:	false
SSDEEP:	1536:h1R0832p+8OhardsoKz8XeWjJFikzlbxbq:LR0832pfOhardsoa8XeWjJFikzFc
MD5:	8E3F521959D597E309C15A8DFFD81638
SHA1:	FD086391DF5409A8B7A2075F0B7753A60070518D
SHA-256:	C9F22A6C84B6CB09B8DC4617D44B79AF1564BDE8CAE130ECC6BA36761F9AF5EF
SHA-512:	132A8578617C223D84ACF05AF76D28E8E159964A7F01C29A7C57399481E50FD047CE30CA0EAA3A19B77D5104E4E65AE5100974D79CABB9359C364FDD4C4AF3B6
Malicious:	false
Yara Hits:	Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2AA.tmp.dmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2AA.tmp.dmp, Author: unknown
Reputation:	low
Preview:	MDMP..a..... .......W..f............D...............L.......$....f..........T.......8...........T...........H6..$...........@...........,!..............................................................................eJ.......!......Lw......................T...........)..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF396.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10228
Entropy (8bit):	3.719384091537201
Encrypted:	false
SSDEEP:	192:R6l7wVeJJx86YcDQnHJgmfKkpDH89b0POf58m:R6lXJ/86YXnHJgmfKR0mfX
MD5:	AC53D3032795F9CE9553EB03A74369A2
SHA1:	F340BBF34BC5F94C02D2EA9AE1F1E0CF8B75FC7F
SHA-256:	BBD5C4FF6ECB57F200E4A1831C2F4FD62E2A6CF0195E309B4FFF66A6EDE311A2
SHA-512:	B2978C535FD5696F2D738590FAD3D5A15B34A7AE1F85658F72AF9600E22A81EB7823BADDE24981CD30C10F6D897DA9AFC931D858CB72067063AFFA0621DAC40C
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.2.0.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3D5.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4693
Entropy (8bit):	4.502807954957068
Encrypted:	false
SSDEEP:	48:cvIwWl8zs9Jg771I9p+WpW8VY9Ym8M4JYBOKFRyq85doOQlkFR/bd:uIjfXI7+/7V9JA1/PlkFNbd
MD5:	745382C41030B861E9F12BEEB23EC113
SHA1:	4D462674E4AE37F0994EAFC4ACD69B5CFD7773F4
SHA-256:	D811D55928B364681B261E3BE51F0CFA7426294DEA8AEA8AB21857AEA72093DD
SHA-512:	8DBA70DFD9E7ED8208A73FEC2FA56895CF2A5C9814DC2E3D273C5BABB544C46FC33A29BB6543A570D87045868A21ADE5291E9F76F94D5F15EB3DBC396831FB42
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="493917" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.394304484077498
Encrypted:	false
SSDEEP:	6144:jl4fiJoH0ncNXiUjt10qpG/gaocYGBoaUMMhA2NX4WABlBuNAmOBSqa:h4vFpMYQUMM6VFYSmU
MD5:	185A4D57B2D8CA069E8D37015095AE3B
SHA1:	6F2879DF9A37BAC4110DFB8436FD7603374BA9DB
SHA-256:	947FF6AF18750CD06BAE6CBF6F9ACB1C1D107B30859DA5F3CB7AAC727354DA3A
SHA-512:	2018091926AA411AA95B7E525EFFEB932B2606EBA579423A04BDE353189A05221D8B366BA7BE218D1EFF0F8EF93EFACF2D4E3F652A88303F6ECB4D0B31145ACB
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm./.._...............................................................................................................................................................................................................................................................................................................................................;&."........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.269430115749708
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QT2hJT3Syn.exe
File size:	67'584 bytes
MD5:	d19f3280851b5e9510a63fe7c80466ae
SHA1:	00e04653569a6d8244edff8765deec3d6ed9c15f
SHA256:	9bfd61a00155017d1a6768326549c65ea9bbe8884b92a7a013e97b507a9167ff
SHA512:	78650af411cfc8a1a1cf05a2538454fa5de7b3c6b6d80eef0193b1d3270389f69f998f1e80768f949167b6075aca1fd70be22b006e11fbd63a725c4097b3a99a
SSDEEP:	1536:mWHMTN/JJ86S4oqiEcpI6rAz/saT4c6WuC0J8:mWIJ8L1U/T4c6W70J8
TLSH:	D963BF9A7B428CFEE95613388123A49EF3F27C111B22ABFF47C601552D633D96C7A650
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Q...Q...Q...X.N.].......R.......X.......H.......W.......T...Q.......B...P...B...R...B...P...RichQ...................PE..d..

File Icon


Icon Hash:	0729494959591b1e

Static PE Info

General

Entrypoint:	0x140001cf4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66B5A165 [Fri Aug 9 04:56:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6102f16ed129485447b57b8b35734f82

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F7504F12F24h
dec eax
add esp, 28h
jmp 00007F7504F1280Fh
int3
int3
jmp 00007F7504F13156h
int3
int3
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [00004664h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00004649h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F7504F12967h
dec eax
lea edx, dword ptr [000091C3h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F7504F13078h
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push ebp
push edi
inc ecx
push esi
dec eax
mov ebp, esp
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc esp
mov edx, edx
inc ecx
xor edx, 49656E69h
inc ecx
xor eax, 6C65746Eh
inc esp
mov ecx, ebx
inc esp
mov esi, eax
xor ecx, ecx
mov eax, 00000001h
cpuid
inc ebp
or edx, eax
mov dword ptr [ebp-10h], eax
inc ecx
xor ecx, 756E6547h
mov dword ptr [ebp-0Ch], ebx
inc ebp
or edx, ecx
mov dword ptr [ebp-08h], ecx
mov edi, ecx
mov dword ptr [ebp-04h], edx
jne 00007F7504F129EDh
dec eax
or dword ptr [0000A26Dh], FFFFFFFFh
and eax, 0FFF3FF0h
dec eax
mov dword ptr [00000055h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaff4	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x56ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xd000	0x438	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0x70	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa3b0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa270	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6000	0x290	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4584	0x4600	d031826de6e0e6fb9ccc321e78e11d07	False	0.5434151785714286	data	6.374369452326817	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6000	0x5bc4	0x5c00	d9c437122c60c894b2f54adf5a7e1a71	False	0.6548488451086957	data	7.210114059723916	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x200	0x200	59db9f2a508b239ec802e9d0119966a6	False	0.26171875	DOS executable (block device driver \377\377\377\377\377\377)	2.224911641545331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xd000	0x438	0x600	221a3fb74e87cf68c7ec77be366c615c	False	0.3580729166666667	data	3.1722964215356337	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0x70	0x200	81c0371bb37172bdb766a9f4233486e2	False	0.224609375	data	1.3216181203289816	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xf000	0x56ec	0x5800	568a6f175845f6ba67d1ccd2ac08b100	False	0.9483753551136364	data	7.839562838980695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf2a8	0x2ec	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0147058823529411
RT_ICON	0xf594	0x592	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0077138849929874
RT_ICON	0xfb28	0x8f4	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0047993019197208
RT_ICON	0x1041c	0x156d	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0020054694621696
RT_ICON	0x1198c	0x324	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.013681592039801
RT_ICON	0x11cb0	0x60c	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0071059431524547
RT_ICON	0x122bc	0x998	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0044788273615635
RT_ICON	0x12c54	0x16b3	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.0018929616245051
RT_GROUP_ICON	0x14308	0x3e	data			0.8709677419354839
RT_GROUP_ICON	0x14348	0x3e	data			0.8870967741935484
RT_VERSION	0x14388	0x364	data	English	United States	0.5483870967741935

Imports

DLL	Import
KERNEL32.dll	HeapCreate, WaitForSingleObject, Sleep, LoadLibraryA, CreateThread, HeapAlloc, GetModuleHandleW, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, QueryPerformanceCounter
USER32.dll	MessageBoxW
MSVCP140.dll	?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ?good@ios_base@std@@QEBA_NXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?uncaught_exception@std@@YA_NXZ, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?_Xlength_error@std@@YAXPEBD@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__current_exception, _CxxThrowException, __current_exception_context, memcpy, __C_specific_handler, __std_exception_copy, __std_exception_destroy, __std_terminate, memset, memchr
api-ms-win-crt-string-l1-1-0.dll	isalnum, strcmp
api-ms-win-crt-runtime-l1-1-0.dll	_initterm_e, _initterm, _register_thread_local_exe_atexit_callback, terminate, _c_exit, _set_app_type, exit, _exit, _seh_filter_exe, _get_narrow_winmain_command_line, _crt_atexit, _register_onexit_function, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _invalid_parameter_noinfo_noreturn, _cexit
api-ms-win-crt-heap-l1-1-0.dll	free, _set_new_mode, malloc, _callnewh
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-10T10:54:09.021829+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49706	116.198.231.169	63222	TCP
2024-09-10T10:54:12.997124+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49709	116.198.231.169	63222	TCP
2024-09-10T10:54:17.184645+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49712	116.198.231.169	63222	TCP
2024-09-10T10:54:21.181917+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49717	116.198.231.169	63222	TCP
2024-09-10T10:54:25.369978+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49721	116.198.231.169	63222	TCP
2024-09-10T10:54:29.532212+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49724	116.198.231.169	63222	TCP
2024-09-10T10:54:33.558180+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49727	116.198.231.169	63222	TCP
2024-09-10T10:54:37.561102+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49730	116.198.231.169	63222	TCP
2024-09-10T10:54:41.639898+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49733	116.198.231.169	63222	TCP
2024-09-10T10:54:45.720763+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49736	116.198.231.169	63222	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 10, 2024 10:54:07.016092062 CEST	49706	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:07.021130085 CEST	63222	49706	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:07.021254063 CEST	49706	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:07.036092043 CEST	49706	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:07.041214943 CEST	63222	49706	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:09.021452904 CEST	63222	49706	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:09.021828890 CEST	49706	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:09.021830082 CEST	49706	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:09.022531986 CEST	49707	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:09.027584076 CEST	63222	49706	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:09.028564930 CEST	63222	49707	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:09.028640985 CEST	49707	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:09.028907061 CEST	49707	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:09.034774065 CEST	63222	49707	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:11.012276888 CEST	63222	49707	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:11.012468100 CEST	49707	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:11.012545109 CEST	49707	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:11.013183117 CEST	49708	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:11.017399073 CEST	63222	49707	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:11.017961025 CEST	63222	49708	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:11.018033028 CEST	49708	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:11.018191099 CEST	49708	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:11.020723104 CEST	49709	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:11.023258924 CEST	63222	49708	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:11.023333073 CEST	49708	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:11.025650978 CEST	63222	49709	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:11.025796890 CEST	49709	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:11.027144909 CEST	49709	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:11.031946898 CEST	63222	49709	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:12.996912956 CEST	63222	49709	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:12.997123957 CEST	49709	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:12.997174025 CEST	49709	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:12.997859001 CEST	49710	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:13.003571987 CEST	63222	49709	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:13.003607035 CEST	63222	49710	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:13.003686905 CEST	49710	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:13.003982067 CEST	49710	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:13.009695053 CEST	63222	49710	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:15.104696035 CEST	63222	49710	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:15.104773998 CEST	49710	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:15.104852915 CEST	49710	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:15.105547905 CEST	49711	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:15.109710932 CEST	63222	49710	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:15.110618114 CEST	63222	49711	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:15.110690117 CEST	49711	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:15.110810041 CEST	49711	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:15.113152027 CEST	49712	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:15.115993023 CEST	63222	49711	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:15.116059065 CEST	49711	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:15.118294954 CEST	63222	49712	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:15.118370056 CEST	49712	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:15.118671894 CEST	49712	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:15.123567104 CEST	63222	49712	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:17.184556961 CEST	63222	49712	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:17.184644938 CEST	49712	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:17.184762001 CEST	49712	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:17.185298920 CEST	49713	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:17.189579010 CEST	63222	49712	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:17.190291882 CEST	63222	49713	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:17.190367937 CEST	49713	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:17.190586090 CEST	49713	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:17.195439100 CEST	63222	49713	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:19.167866945 CEST	63222	49713	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:19.167947054 CEST	49713	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:19.168054104 CEST	49713	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:19.168622971 CEST	49716	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:19.172873974 CEST	63222	49713	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:19.173470020 CEST	63222	49716	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:19.173548937 CEST	49716	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:19.173671007 CEST	49716	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:19.178932905 CEST	63222	49716	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:19.178989887 CEST	49716	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:19.183950901 CEST	49717	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:19.188929081 CEST	63222	49717	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:19.188997030 CEST	49717	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:19.190561056 CEST	49717	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:19.195528984 CEST	63222	49717	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:21.181823015 CEST	63222	49717	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:21.181916952 CEST	49717	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:21.182200909 CEST	49717	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:21.183110952 CEST	49719	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:21.186930895 CEST	63222	49717	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:21.188055038 CEST	63222	49719	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:21.188150883 CEST	49719	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:21.188486099 CEST	49719	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:21.193314075 CEST	63222	49719	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:23.246778965 CEST	63222	49719	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:23.246881962 CEST	49719	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:23.276552916 CEST	49719	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:23.278177977 CEST	49720	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:23.281780958 CEST	63222	49719	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:23.283040047 CEST	63222	49720	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:23.283150911 CEST	49720	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:23.284111977 CEST	49720	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:23.288630962 CEST	49721	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:23.289196968 CEST	63222	49720	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:23.289252996 CEST	49720	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:23.293617010 CEST	63222	49721	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:23.293698072 CEST	49721	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:23.294167995 CEST	49721	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:23.299197912 CEST	63222	49721	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:25.369527102 CEST	63222	49721	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:25.369977951 CEST	49721	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:25.369977951 CEST	49721	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:25.370637894 CEST	49722	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:25.374855995 CEST	63222	49721	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:25.375441074 CEST	63222	49722	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:25.375513077 CEST	49722	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:25.375744104 CEST	49722	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:25.380538940 CEST	63222	49722	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:27.451416969 CEST	63222	49722	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:27.451642990 CEST	49722	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:27.451745033 CEST	49722	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:27.452615976 CEST	49723	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:27.456885099 CEST	63222	49722	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:27.457632065 CEST	63222	49723	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:27.457719088 CEST	49723	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:27.457814932 CEST	49723	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:27.460241079 CEST	49724	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:27.463067055 CEST	63222	49723	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:27.463130951 CEST	49723	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:27.465142965 CEST	63222	49724	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:27.465209961 CEST	49724	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:27.465545893 CEST	49724	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:27.470361948 CEST	63222	49724	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:29.532124996 CEST	63222	49724	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:29.532212019 CEST	49724	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:29.532360077 CEST	49724	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:29.537158966 CEST	63222	49724	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:29.537523985 CEST	49725	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:29.542424917 CEST	63222	49725	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:29.542541027 CEST	49725	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:29.542953014 CEST	49725	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:29.547945023 CEST	63222	49725	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:31.567467928 CEST	63222	49725	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:31.567590952 CEST	49725	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:31.567713976 CEST	49725	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:31.571324110 CEST	49726	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:31.572571993 CEST	63222	49725	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:31.576250076 CEST	63222	49726	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:31.576364040 CEST	49726	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:31.576531887 CEST	49726	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:31.581576109 CEST	49727	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:31.581733942 CEST	63222	49726	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:31.581799984 CEST	49726	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:31.586484909 CEST	63222	49727	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:31.586555958 CEST	49727	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:31.586843014 CEST	49727	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:31.591768026 CEST	63222	49727	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:33.558120012 CEST	63222	49727	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:33.558180094 CEST	49727	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:33.558372021 CEST	49727	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:33.562309980 CEST	49728	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:33.563705921 CEST	63222	49727	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:33.569133043 CEST	63222	49728	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:33.569209099 CEST	49728	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:33.569993019 CEST	49728	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:33.575047016 CEST	63222	49728	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:35.571562052 CEST	63222	49728	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:35.571686029 CEST	49728	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:35.571830988 CEST	49728	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:35.572523117 CEST	49729	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:35.576606989 CEST	63222	49728	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:35.577461958 CEST	63222	49729	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:35.577547073 CEST	49729	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:35.577619076 CEST	49729	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:35.579514980 CEST	49730	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:35.582861900 CEST	63222	49729	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:35.582928896 CEST	49729	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:35.584383011 CEST	63222	49730	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:35.584456921 CEST	49730	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:35.584702015 CEST	49730	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:35.589514971 CEST	63222	49730	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:37.560899019 CEST	63222	49730	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:37.561101913 CEST	49730	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:37.561212063 CEST	49730	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:37.563808918 CEST	49731	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:37.566200018 CEST	63222	49730	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:37.569186926 CEST	63222	49731	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:37.569258928 CEST	49731	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:37.569531918 CEST	49731	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:37.575814962 CEST	63222	49731	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:39.582501888 CEST	63222	49731	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:39.582585096 CEST	49731	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:39.582681894 CEST	49731	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:39.586247921 CEST	49732	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:39.587562084 CEST	63222	49731	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:39.591150045 CEST	63222	49732	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:39.591223955 CEST	49732	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:39.591350079 CEST	49732	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:39.593759060 CEST	49733	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:39.596689939 CEST	63222	49732	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:39.596738100 CEST	49732	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:39.598694086 CEST	63222	49733	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:39.598774910 CEST	49733	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:39.599127054 CEST	49733	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:39.604013920 CEST	63222	49733	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:41.639740944 CEST	63222	49733	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:41.639898062 CEST	49733	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:41.640079021 CEST	49733	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:41.643310070 CEST	49734	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:41.644928932 CEST	63222	49733	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:41.648292065 CEST	63222	49734	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:41.648375988 CEST	49734	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:41.648718119 CEST	49734	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:41.653645992 CEST	63222	49734	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:43.688385010 CEST	63222	49734	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:43.688458920 CEST	49734	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:43.688575029 CEST	49734	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:43.692219973 CEST	49735	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:43.693375111 CEST	63222	49734	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:43.697324991 CEST	63222	49735	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:43.697393894 CEST	49735	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:43.697510958 CEST	49735	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:43.701380968 CEST	49736	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:43.702502012 CEST	63222	49735	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:43.702564001 CEST	49735	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:43.706326008 CEST	63222	49736	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:43.706449032 CEST	49736	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:43.706831932 CEST	49736	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:43.711602926 CEST	63222	49736	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:45.720673084 CEST	63222	49736	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:45.720762968 CEST	49736	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:45.720877886 CEST	49736	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:45.724683046 CEST	49737	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:45.725920916 CEST	63222	49736	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:45.729635000 CEST	63222	49737	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:45.729727030 CEST	49737	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:45.730057955 CEST	49737	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:45.734935999 CEST	63222	49737	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:47.717924118 CEST	63222	49737	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:47.718033075 CEST	49737	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:47.718203068 CEST	49737	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:47.720426083 CEST	49738	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:47.724200964 CEST	63222	49737	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:47.725434065 CEST	63222	49738	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:47.725502014 CEST	49738	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:47.725620985 CEST	49738	63222	192.168.2.9	116.198.231.169
Sep 10, 2024 10:54:47.730977058 CEST	63222	49738	116.198.231.169	192.168.2.9
Sep 10, 2024 10:54:47.731024981 CEST	49738	63222	192.168.2.9	116.198.231.169

Target ID:	0
Start time:	04:54:01
Start date:	10/09/2024
Path:	C:\Users\user\Desktop\QT2hJT3Syn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\QT2hJT3Syn.exe"
Imagebase:	0x7ff6c3900000
File size:	67'584 bytes
MD5 hash:	D19F3280851B5E9510A63FE7C80466AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:54:47
Start date:	10/09/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 420 -s 1420
Imagebase:	0x7ff7a1930000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	6.9%
Signature Coverage:	30.7%
Total number of Nodes:	261
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF6C3903EB0 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 302
memorysleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxW.USER32 ref: 00007FF6C3903EE2
memcpy.VCRUNTIME140(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C3903F05
memcpy.VCRUNTIME140 ref: 00007FF6C3903F8F
memcpy.VCRUNTIME140(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C3904030
memset.VCRUNTIME140(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C39040B6
memset.VCRUNTIME140(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C3904106
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C390422B
VirtualProtect.KERNELBASE(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C3904261
LoadLibraryA.KERNEL32(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C390426A
CreateThread.KERNELBASE ref: 00007FF6C3904286
WaitForSingleObject.KERNEL32(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C3904294
HeapCreate.KERNEL32(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C39042A7
HeapAlloc.KERNEL32(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C39042BB
memcpy.VCRUNTIME140(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C39042D1
Sleep.KERNEL32(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C39042DD

Part of subcall function 00007FF6C3901818: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF6C390100E), ref: 00007FF6C3901832

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,?,00000000,?,00007FF6C3901C86), ref: 00007FF6C390432F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C3904351

Strings

VirtualProtect, xrefs: 00007FF6C3904241
rW/xHjl/tpwqf1jaiPmqhwLTh/9V+0ClGm9TOkOcD5z/T4vuhcMWvccRToRnKodSXfv3fSUMfPE6HBpgW6PiXjGOslgM0HbL2BrCFb+ChiWMg7HLEpejgVGYwPZdvNhe8n5PcmSJtUFshxv0HtreU7iJABqRT6gm2O7nG9z2fd6wruUBN/we2QsjOTQ3El7aaLkEhYWQTuVJnyogTuU1PjvIYQe4B6ZL7gaqArtsu8VAJJuT5mPIceKgQo8wZKJn6SdG, xrefs: 00007FF6C3903EFE
GetProcAddress, xrefs: 00007FF6C3904216
kernel32.dll, xrefs: 00007FF6C3904263

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID: memcpy$CreateHeapmemset$AllocConcurrency::cancel_current_taskLibraryLoadMessageObjectProtectSingleSleepThreadVirtualWait_invalid_parameter_noinfo_noreturnmallocstrcmp
String ID: GetProcAddress$VirtualProtect$kernel32.dll$rW/xHjl/tpwqf1jaiPmqhwLTh/9V+0ClGm9TOkOcD5z/T4vuhcMWvccRToRnKodSXfv3fSUMfPE6HBpgW6PiXjGOslgM0HbL2BrCFb+ChiWMg7HLEpejgVGYwPZdvNhe8n5PcmSJtUFshxv0HtreU7iJABqRT6gm2O7nG9z2fd6wruUBN/we2QsjOTQ3El7aaLkEhYWQTuVJnyogTuU1PjvIYQe4B6ZL7gaqArtsu8VAJJuT5mPIceKgQo8wZKJn6SdG
API String ID: 1700708136-1027293778
Opcode ID: f9bc0d7294f68d03651fd688e6f71cc41f92d764ef2405ada01706ca51ef2039
Instruction ID: 1cb5c2e6c94f5a250767254c202775518a856036c5877e24eadf7e045eb906bb
Opcode Fuzzy Hash: f9bc0d7294f68d03651fd688e6f71cc41f92d764ef2405ada01706ca51ef2039
Instruction Fuzzy Hash: 08D1F722A08AC285EB10CF25D441BFE6761FB58796F404231EA9EA76D7EF3CD585CB00

Function 0000000902FAE7E0 Relevance: 1.8, APIs: 1, Instructions: 295
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectA.WININET(00000003,00000003,00000002,00000001), ref: 0000000902FAE7FB

Part of subcall function 0000000902FAE7FF: HttpOpenRequestA.WININET(00000000,00000000,84C03200,00000000), ref: 0000000902FAE81A

Memory Dump Source

Source File: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, Offset: 0000000902FAE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_902fae000_QT2hJT3Syn.jbxd

Yara matches

Similarity

API ID: ConnectHttpInternetOpenRequest
String ID:
API String ID: 1341064763-0
Opcode ID: e3167bb3e8b5aeea410c5bda1354292710fbe9dd2fdc2113092930280f81d543
Instruction ID: c5138fa9583434a1ac020ca43846f1f85ad8a052ea9c146c137d880f5fa95f9b
Opcode Fuzzy Hash: e3167bb3e8b5aeea410c5bda1354292710fbe9dd2fdc2113092930280f81d543
Instruction Fuzzy Hash: 9DA190719183975EFB6A9B38846E366BFF5FB19390F2805BDC2C18B1E7D1509802C74A

Function 00007FF6C3901B80 Relevance: 10.6, APIs: 7, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6C3901BA4
__scrt_release_startup_lock.LIBCMT ref: 00007FF6C3901C12
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C3901C60
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6C3901C65
_get_narrow_winmain_command_line.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C3901C6D
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C3901C96
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C3901CEB

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_release_startup_lock_cexit_exit_get_narrow_winmain_command_line_register_thread_local_exe_atexit_callback
String ID:
API String ID: 3995423050-0
Opcode ID: 1a752565a283e8bc6c4718bd7f0bfa4515868e64581fd36a0b3e31664e51b0ac
Instruction ID: ac323e1f0586e1d5b0bc2118fa0404532b5ec251c8522df96f49f91161b978e5
Opcode Fuzzy Hash: 1a752565a283e8bc6c4718bd7f0bfa4515868e64581fd36a0b3e31664e51b0ac
Instruction Fuzzy Hash: 4B310C25E0C2D385FA54AF659453BB922A1AF4D786F444034E9CEFB2D3FE6CE8048291

Function 0000000902FAE7A6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56
librarynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000000902FAE7C1
InternetOpenA.WININET(00000000,00000000), ref: 0000000902FAE7D9

Strings

wini, xrefs: 0000000902FAE7AA

Memory Dump Source

Source File: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, Offset: 0000000902FAE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_902fae000_QT2hJT3Syn.jbxd

Yara matches

Similarity

API ID: InternetLibraryLoadOpen
String ID: wini
API String ID: 2559873147-1606035523
Opcode ID: 5f93fe04556e9114a692b7a8cb09660883b66be0f4b4a600167b52d13b5f35d2
Instruction ID: fccbab18af54b7468763034c97b509e31ff6ed364c598b70a499d579114c9cea
Opcode Fuzzy Hash: 5f93fe04556e9114a692b7a8cb09660883b66be0f4b4a600167b52d13b5f35d2
Instruction Fuzzy Hash: 5D01DAB005C2469FE32D8F30880B37B7AA6EB42B05F2454BEE1C3864A3C92108428B86

Function 0000000902FAE7FF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpOpenRequestA.WININET(00000000,00000000,84C03200,00000000), ref: 0000000902FAE81A

Strings

U.;, xrefs: 0000000902FAE815

Memory Dump Source

Source File: 00000000.00000002.1862615257.0000000902FAE000.00000040.00000010.00020000.00000000.sdmp, Offset: 0000000902FAE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_902fae000_QT2hJT3Syn.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: U.;
API String ID: 1984915467-4213443877
Opcode ID: 0673e6ba89fcafa97f45a20ababb8eb16fe70298331e982a3612c8fa0d542fd6
Instruction ID: a9717c00710bbb5696ef4c34c3e51ef4cde02bbfc62673a94976bc5d149a3531
Opcode Fuzzy Hash: 0673e6ba89fcafa97f45a20ababb8eb16fe70298331e982a3612c8fa0d542fd6
Instruction Fuzzy Hash: A111B2A034890E1BF65C929D7C5A73611CAD3D8755F20813FB54EC33D6DC54CC83816A

Non-executed Functions

Function 00007FF6C3904360 Relevance: 15.9, APIs: 10, Instructions: 882
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C39039C0: isalnum.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000,00000000), ref: 00007FF6C3903A51
Part of subcall function 00007FF6C39039C0: memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF6C3903ACC
Part of subcall function 00007FF6C39039C0: memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF6C3903B03

memcpy.VCRUNTIME140 ref: 00007FF6C39043C8
memcpy.VCRUNTIME140 ref: 00007FF6C39043F3
memcpy.VCRUNTIME140 ref: 00007FF6C3904446
memset.VCRUNTIME140 ref: 00007FF6C39044D1
memset.VCRUNTIME140 ref: 00007FF6C3904518
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C390516F

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID: memcpy$memchrmemset$_invalid_parameter_noinfo_noreturnisalnum
String ID:
API String ID: 581468037-0
Opcode ID: 8ef4aaa22b329a95060205e8a9b0493baab4ad5e0559fcd37528c45140d44259
Instruction ID: dce232b982861def789d238e5284f9c79cbef6d530cadf70fb9730db8b5a2d5c
Opcode Fuzzy Hash: 8ef4aaa22b329a95060205e8a9b0493baab4ad5e0559fcd37528c45140d44259
Instruction Fuzzy Hash: 0C8223726082D08BD7258F389450AFE7BA1F74974AF459125DBCAAB786DF3CE600CB40

Function 00007FF6C3902038 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6C3902054
memset.VCRUNTIME140 ref: 00007FF6C3902078
RtlCaptureContext.KERNEL32 ref: 00007FF6C3902081
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C390209B
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C39020DC
memset.VCRUNTIME140 ref: 00007FF6C390210F
IsDebuggerPresent.KERNEL32 ref: 00007FF6C3902130
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C390214D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C3902158

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 9ffe9f7a2552eabd9cbd91c231be09652aabbf0b04a8f210b51f505912c4f0c6
Instruction ID: bb0acca2e906cf8292496f3d16826426cb8fa049f0811d9cc0827970119531e7
Opcode Fuzzy Hash: 9ffe9f7a2552eabd9cbd91c231be09652aabbf0b04a8f210b51f505912c4f0c6
Instruction Fuzzy Hash: C7310F72609BC186EB609F61E8417EE7374FB88745F44403ADA8E97B96EF38D548C710

Function 00007FF6C390228C Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6C39022B8
GetCurrentThreadId.KERNEL32 ref: 00007FF6C39022C6
GetCurrentProcessId.KERNEL32 ref: 00007FF6C39022D2
QueryPerformanceCounter.KERNEL32 ref: 00007FF6C39022E2

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0fbad5fd6f2767220c7461670684e260ec7aafaf3dc54847602cb2efa943320e
Instruction ID: 5490a7a432076fccccb0187f1549df65bedbe7a4ecccc6c630faff4cf25df982
Opcode Fuzzy Hash: 0fbad5fd6f2767220c7461670684e260ec7aafaf3dc54847602cb2efa943320e
Instruction Fuzzy Hash: 48114822B14B418AEB00DF61E8466B833B4FB1D759F440E31DAAD967A5EF3CE1988340

Function 00007FF6C39025E0 Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FF6C39026B3
memset.VCRUNTIME140 ref: 00007FF6C39026E6

Strings

, xrefs: 00007FF6C390264E

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-3916222277
Opcode ID: 10fe64071739a2ded2f0a5419cf26234a9cb385721e058ba0fcc83c8cc307c78
Instruction ID: d4636727b37755a381ac28643842976c48f724942c1b2af7e6ad97c49d07bc89
Opcode Fuzzy Hash: 10fe64071739a2ded2f0a5419cf26234a9cb385721e058ba0fcc83c8cc307c78
Instruction Fuzzy Hash: A8C1F272B182D186E715CF289541BBD3BE0E749B45F858036DACDEB346EE78E541C710

Function 00007FF6C3902A60 Relevance: 1.7, APIs: 1, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d9fd08a1a3572f31eb62606a6418c6cd1bf873439365f6d5667c21df0fb5db
Instruction ID: 87067800045348fa2b8d1e673e95ffc946a821e502c0a3e4178842cc5d588dea
Opcode Fuzzy Hash: 68d9fd08a1a3572f31eb62606a6418c6cd1bf873439365f6d5667c21df0fb5db
Instruction Fuzzy Hash: D31256732087E48AC7108F2D98409BE7FA4F399B4AF498215EFC987786CA3DE615C750

Function 00007FF6C3902DC0 Relevance: 1.7, APIs: 1, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16f77bd1055aef42d53165e0a7d8d775166ff36071f674d1390ceb6bc1ed32d
Instruction ID: f20880916a1e40af2154d8584ab9ab1de3ff11bdfb02c0af54637a4cdfbe69b2
Opcode Fuzzy Hash: d16f77bd1055aef42d53165e0a7d8d775166ff36071f674d1390ceb6bc1ed32d
Instruction Fuzzy Hash: 841246736083E48AD7108F2D98449AE7FA4F389B4AF4A8215DFC897782CA3CF515C720

Function 00007FF6C390221C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 185bb21c631b42b625ea131c3156779a1e8468bba62d3009b45224cd70e431eb
Instruction ID: 3345a7038a6cb1f7dd95bf2877943e5f028b1b3069557cff6fdfe53151a01276
Opcode Fuzzy Hash: 185bb21c631b42b625ea131c3156779a1e8468bba62d3009b45224cd70e431eb
Instruction Fuzzy Hash: E3A00162949886A0E6198F55A9528342230EB58302B418432C08DA1062AF2DE4488201

Function 00007FF6C3901260 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C39012B8
memcpy.VCRUNTIME140 ref: 00007FF6C3901328
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C3901397
memcpy.VCRUNTIME140 ref: 00007FF6C39013BA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C39013E7
memcpy.VCRUNTIME140 ref: 00007FF6C39014D4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6C3901511
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C3901552

Strings

string too long, xrefs: 00007FF6C3901244

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemcpy$Concurrency::cancel_current_task
String ID: string too long
API String ID: 621473597-2556327735
Opcode ID: dc214a706161d04807a1c17e90786c25c00201b982d4ed9808e8b67d56e755a6
Instruction ID: 1b6724a565dbbb7afea20c40fc1f375b4530d70b58d44a9d5668831c11131e2f
Opcode Fuzzy Hash: dc214a706161d04807a1c17e90786c25c00201b982d4ed9808e8b67d56e755a6
Instruction Fuzzy Hash: 40812526B08BC184EA149F65A04176D23A1EB08BD5F544635DBEE9BBD7EF7CE0818380

Function 00007FF6C3901560 Relevance: 13.6, APIs: 9, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6C39015BD
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF6C39015DD
?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6C39015ED
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6C3901636
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF6C3901666
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6C3901688
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6C39016CE
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF6C39016D5
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF6C39016E2

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?good@ios_base@std@@?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 3274656010-0
Opcode ID: 2d83f5bf139d5ddab99d305bf5690e1c03955fd8ff749a6140a8785ce57e8d76
Instruction ID: f0685cfbe42b51a3941e2cbfa8a31d09fbabc182b5329bb1fbdf3905f04553a1
Opcode Fuzzy Hash: 2d83f5bf139d5ddab99d305bf5690e1c03955fd8ff749a6140a8785ce57e8d76
Instruction Fuzzy Hash: E9518436608A8181EB209F1AE591A3CA7B1EF89F93F15C531CA9F977A2DF3DD4458340

Function 00007FF6C39039C0 Relevance: 12.8, APIs: 10, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

isalnum.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000,00000000), ref: 00007FF6C3903A51
memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF6C3903ACC
memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF6C3903B03
memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF6C3903B46
memchr.VCRUNTIME140(?,00000000,00000000), ref: 00007FF6C3903B89
memset.VCRUNTIME140(00000000,?,00000000,00000000), ref: 00007FF6C3903CC8
memchr.VCRUNTIME140(00000000,?,00000000,00000000), ref: 00007FF6C3903D02
memchr.VCRUNTIME140(00000000,?,00000000,00000000), ref: 00007FF6C3903D3F
memchr.VCRUNTIME140 ref: 00007FF6C3903D7E
memchr.VCRUNTIME140 ref: 00007FF6C3903DBD

Part of subcall function 00007FF6C3901260: memcpy.VCRUNTIME140 ref: 00007FF6C39014D4

Memory Dump Source

Source File: 00000000.00000002.1863232775.00007FF6C3901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6C3900000, based on PE: true

Associated: 00000000.00000002.1863220053.00007FF6C3900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863246371.00007FF6C3906000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863260514.00007FF6C390C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1863273593.00007FF6C390D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6c3900000_QT2hJT3Syn.jbxd

Similarity

API ID: memchr$isalnummemcpymemset
String ID:
API String ID: 2613388124-0
Opcode ID: 1c4aa18a20eb7564f907b3e35b9d161b37e06d40664dc32e136580126c14a596
Instruction ID: 279e9c04426c9547dc69f0747231142b4b2d13ed9086393c372ae120869ad310
Opcode Fuzzy Hash: 1c4aa18a20eb7564f907b3e35b9d161b37e06d40664dc32e136580126c14a596
Instruction Fuzzy Hash: AFD10862B097D285EB019F2594826792B92EB09FEAF144235DDADA7BD7EF3CD401D300

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QT2hJT3Syn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Threatname: Metasploit

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QT2hJT3Syn.exe_7f1a37c4c18389bc5a9768bc74304b343de52_f3ab7727_f8dad36d-3db4-4f4b-aff7-272943b6f4c3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2AA.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF396.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3D5.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
QT2hJT3Syn.exe

Function 00007FF6C3903EB0 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 302
memorysleeplibraryCOMMON

Function 0000000902FAE7E0 Relevance: 1.8, APIs: 1, Instructions: 295
networkCOMMON

Function 00007FF6C3901B80 Relevance: 10.6, APIs: 7, Instructions: 94
COMMON

Function 0000000902FAE7A6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56
librarynetworkCOMMON

Function 0000000902FAE7FF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99
networkCOMMON

Function 00007FF6C3904360 Relevance: 15.9, APIs: 10, Instructions: 882
COMMON

Function 00007FF6C3902038 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Function 00007FF6C390228C Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMON

Function 00007FF6C39025E0 Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 294
COMMON

Function 00007FF6C3901260 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 217
COMMON

Function 00007FF6C3901560 Relevance: 13.6, APIs: 9, Instructions: 124
COMMON

Function 00007FF6C39039C0 Relevance: 12.8, APIs: 10, Instructions: 329
COMMON