Edit tour

Windows Analysis Report
TEiot52yrz.exe

Overview

General Information

Sample name:	TEiot52yrz.exe renamed because original name is a hash value
Original sample name:	915cc233f5c3b36f2aa5a9a0aa2fcd28b8ee406e42c08b71177dab901c219d41.exe
Analysis ID:	1508525
MD5:	fa332de9a0e7da5e975173ee47246172
SHA1:	c6e74c68a11a9d318137aba895f2bcde89d42f2b
SHA256:	915cc233f5c3b36f2aa5a9a0aa2fcd28b8ee406e42c08b71177dab901c219d41
Tags:	116-198-231-169exe
Infos:

Detection

CobaltStrike, Metasploit

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected Metasploit Payload

C2 URLs / IPs found in malware configuration

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

One or more processes crash

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

TEiot52yrz.exe (PID: 7788 cmdline: "C:\Users\user\Desktop\TEiot52yrz.exe" MD5: FA332DE9A0E7DA5E975173EE47246172)

WerFault.exe (PID: 5848 cmdline: C:\Windows\system32\WerFault.exe -u -p 7788 -s 1192 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"C2Server": "http://116.198.231.169:63222/jquery-3.3.2.slim.min.js", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n"}

Threatname: Metasploit

{"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://code.jquery.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://116.198.231.169/jquery-3.3.2.slim.min.js"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A1.tmp.dmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x1bd79:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A1.tmp.dmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x1bde5:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x61:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0xcd:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T10:55:16.172006+0200	2028765	3	Unknown Traffic	192.168.2.10	49707	116.198.231.169	63222	TCP
2024-09-10T10:55:20.852883+0200	2028765	3	Unknown Traffic	192.168.2.10	49710	116.198.231.169	63222	TCP
2024-09-10T10:55:25.060105+0200	2028765	3	Unknown Traffic	192.168.2.10	49713	116.198.231.169	63222	TCP
2024-09-10T10:55:29.314528+0200	2028765	3	Unknown Traffic	192.168.2.10	49716	116.198.231.169	63222	TCP
2024-09-10T10:55:33.550685+0200	2028765	3	Unknown Traffic	192.168.2.10	49723	116.198.231.169	63222	TCP
2024-09-10T10:55:37.934760+0200	2028765	3	Unknown Traffic	192.168.2.10	49726	116.198.231.169	63222	TCP
2024-09-10T10:55:42.196559+0200	2028765	3	Unknown Traffic	192.168.2.10	49729	116.198.231.169	63222	TCP
2024-09-10T10:55:46.376638+0200	2028765	3	Unknown Traffic	192.168.2.10	49732	116.198.231.169	63222	TCP
2024-09-10T10:55:50.479481+0200	2028765	3	Unknown Traffic	192.168.2.10	49735	116.198.231.169	63222	TCP
2024-09-10T10:55:55.331575+0200	2028765	3	Unknown Traffic	192.168.2.10	49738	116.198.231.169	63222	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: TEiot52yrz.exe

Avira: detected

Found malware configuration

Source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp	Malware Configuration Extractor: CobaltStrike {"C2Server": "http://116.198.231.169:63222/jquery-3.3.2.slim.min.js", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n"}
Source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp	Malware Configuration Extractor: Metasploit {"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://code.jquery.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://116.198.231.169/jquery-3.3.2.slim.min.js"}

Multi AV Scanner detection for submitted file

Source: TEiot52yrz.exe	ReversingLabs: Detection: 60%
Source: TEiot52yrz.exe	Virustotal: Detection: 60%			Perma Link

Source: TEiot52yrz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://116.198.231.169:63222/jquery-3.3.2.slim.min.js
Source: Malware configuration extractor	URLs: http://116.198.231.169/jquery-3.3.2.slim.min.js

Source: global traffic

TCP traffic: 192.168.2.10:49707 -> 116.198.231.169:63222

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.10:49710 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.10:49716 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.10:49738 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.10:49726 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.10:49735 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.10:49713 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.10:49723 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.10:49729 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.10:49732 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.10:49707 -> 116.198.231.169:63222

Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169

Source: TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703107624.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1723907163.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/
Source: TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/(
Source: TEiot52yrz.exe, 00000007.00000003.1654586335.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1613554998.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703107624.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1723907163.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/9
Source: TEiot52yrz.exe, 00000007.00000003.1703107624.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1723907163.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/k
Source: TEiot52yrz.exe, 00000007.00000003.1703107624.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1723907163.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/p
Source: TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/q
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net
Source: TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169/
Source: TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169/r
Source: TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/
Source: TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/X/W
Source: TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/d
Source: TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000002.1772520465.000002242F72C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.js
Source: TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsa0
Source: TEiot52yrz.exe, 00000007.00000002.1772520465.000002242F72C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsb
Source: TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/k
Source: TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/l
Source: TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/pData

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A1.tmp.dmp, type: DROPPED	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A1.tmp.dmp, type: DROPPED	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown

Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 7_2_00007FF6E7F55D5C	7_2_00007FF6E7F55D5C
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 7_2_00007FF6E7F55785	7_2_00007FF6E7F55785
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 7_2_00007FF6E7F53DE8	7_2_00007FF6E7F53DE8
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 7_2_00007FF6E7F5603A	7_2_00007FF6E7F5603A
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 7_2_00007FF6E7F554A4	7_2_00007FF6E7F554A4
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 7_2_00000076FB5BE122	7_2_00000076FB5BE122

Source: C:\Users\user\Desktop\TEiot52yrz.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7788 -s 1192

Source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A1.tmp.dmp, type: DROPPED	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A1.tmp.dmp, type: DROPPED	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23

Source: classification engine

Classification label: mal92.troj.winEXE@2/5@0/1

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7788

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4ce0ec32-25f2-44d7-9afb-bc7d0bd7b482

Jump to behavior

Source: TEiot52yrz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TEiot52yrz.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TEiot52yrz.exe	ReversingLabs: Detection: 60%
Source: TEiot52yrz.exe	Virustotal: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\TEiot52yrz.exe "C:\Users\user\Desktop\TEiot52yrz.exe"
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7788 -s 1192

Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\TEiot52yrz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: TEiot52yrz.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: TEiot52yrz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: TEiot52yrz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 7_2_00000076FB5BE17B push eax; ret		7_2_00000076FB5BE3D7
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 7_2_00000076FB5BE359 push eax; ret		7_2_00000076FB5BE3D7

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F7A1000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F7A1000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F760000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F7A1000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F761000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F761000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F7A1000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F7A1000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F7A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: VMware-42 27 ae 88 8c 2b 21 02-a5 86 22 5b 84 51 ac f0
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\TEiot52yrz.exe

Code function: 7_2_00007FF6E7F5365C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_00007FF6E7F5365C

Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 7_2_00007FF6E7F52B74 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF6E7F52B74
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 7_2_00007FF6E7F53804 SetUnhandledExceptionFilter,	7_2_00007FF6E7F53804
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 7_2_00007FF6E7F5365C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF6E7F5365C

Source: C:\Users\user\Desktop\TEiot52yrz.exe

Code function: 7_2_00007FF6E7F53874 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

7_2_00007FF6E7F53874

Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: MsMpEng.exe

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match

File source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY

Yara detected Metasploit Payload

Source: Yara match

File source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TEiot52yrz.exe	61%	ReversingLabs	Win64.Backdoor.MeterpreterReverseShell
TEiot52yrz.exe	60%	Virustotal		Browse
TEiot52yrz.exe	100%	Avira	TR/AD.MeterpreterSC.zrtjs

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
https://116.198.231.169:63222/k	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/l	0%	Avira URL Cloud	safe
http://116.198.231.169:63222/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
http://code.jquery.com/	0%	Avira URL Cloud	safe
http://code.jquery.com/(	0%	Avira URL Cloud	safe
http://code.jquery.com/k	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/d	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsb	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/	0%	Avira URL Cloud	safe
http://code.jquery.com/9	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/pData	0%	Avira URL Cloud	safe
https://116.198.231.169/r	0%	Avira URL Cloud	safe
http://code.jquery.com/q	0%	Avira URL Cloud	safe
http://code.jquery.com/p	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsa0	0%	Avira URL Cloud	safe
https://116.198.231.169/	0%	Avira URL Cloud	safe
http://116.198.231.169/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/X/W	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://116.198.231.169:63222/jquery-3.3.2.slim.min.js	true	Avira URL Cloud: safe	unknown
http://116.198.231.169/jquery-3.3.2.slim.min.js	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://116.198.231.169:63222/l	TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/k	TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/(	TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/	TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703107624.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1723907163.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://code.jquery.com/k	TEiot52yrz.exe, 00000007.00000003.1703107624.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1723907163.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/d	TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsb	TEiot52yrz.exe, 00000007.00000002.1772520465.000002242F72C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.js	TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000002.1772520465.000002242F72C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/	TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/9	TEiot52yrz.exe, 00000007.00000003.1654586335.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1613554998.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703107624.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1723907163.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.12.dr	false	URL Reputation: safe	unknown
https://116.198.231.169:63222/pData	TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169/r	TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F760000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/q	TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/p	TEiot52yrz.exe, 00000007.00000003.1703107624.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1723907163.000002242F7B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsa0	TEiot52yrz.exe, 00000007.00000002.1772601417.000002242F77E000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169/	TEiot52yrz.exe, 00000007.00000003.1703154920.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/X/W	TEiot52yrz.exe, 00000007.00000003.1591840224.000002242F77E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.198.231.169	unknown	China		137699	CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1508525
Start date and time:	2024-09-10 10:54:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TEiot52yrz.exe renamed because original name is a hash value
Original Sample Name:	915cc233f5c3b36f2aa5a9a0aa2fcd28b8ee406e42c08b71177dab901c219d41.exe
Detection:	MAL
Classification:	mal92.troj.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 4 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
04:56:01	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
116.198.231.169	LtmV2sDcTK.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
116.198.231.169	QT2hJT3Syn.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian	LtmV2sDcTK.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	QT2hJT3Syn.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	gOEF4WOJ3c.elf	Get hash	malicious	Unknown	Browse	116.198.238.210

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_TEiot52yrz.exe_d23f16c97e88e178369da9a9b73acf7cc86966_8fd4efbb_14680be6-56b5-4a96-a3b1-60837cf7e648\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.923354596152919
Encrypted:	false
SSDEEP:	96:SQF/D1ZQs4hqKeoh7Rb6NbQXIDcQWc6zcEZcw37n+HbHg/JgwPt8sKa9bATFUp2f:XVQU60I3DEjc4bzuiFrCZ24lO8Z
MD5:	492FE676002D4AE241A06642AAB9E226
SHA1:	139896AA9E2FD77DF1ADC5E3970EA692A701F4B6
SHA-256:	20BA5509063F1EE5CBA9BF6EE9908545C85031EE4A692BD7A214AA1D7A1F9012
SHA-512:	772DBFFA33C86BE0607091DD276881CE73BFA02B0AF4C81B89374ADA24081CA7BBA59395DAD203AB496A212606302BB27260C28A1EDFB820BB3193A36C866640
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.4.3.2.1.5.7.3.2.3.4.3.2.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.4.3.2.1.5.7.6.8.2.8.2.5.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.4.6.8.0.b.e.6.-.5.6.b.5.-.4.a.9.6.-.a.3.b.1.-.6.0.8.3.7.c.f.7.e.6.4.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.6.a.4.4.b.c.b.-.5.6.4.d.-.4.3.f.b.-.a.2.2.8.-.0.9.1.3.8.5.b.4.9.4.e.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.T.E.i.o.t.5.2.y.r.z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.c.-.0.0.0.1.-.0.0.1.3.-.2.4.5.e.-.a.0.2.5.5.f.0.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.8.0.0.7.2.f.0.1.5.e.8.9.b.6.b.4.5.f.8.7.8.a.2.5.c.5.7.b.f.f.9.0.0.0.0.f.f.f.f.!.0.0.0.0.c.6.e.7.4.c.6.8.a.1.1.a.9.d.3.1.8.1.3.7.a.b.a.8.9.5.f.2.b.c.d.e.8.9.d.4.2.f.2.b.!.T.E.i.o.t.5.2.y.r.z...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.6././.2.1.:.1.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A1.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Sep 10 08:55:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	142820
Entropy (8bit):	1.4843651892308436
Encrypted:	false
SSDEEP:	384:YL79P9R3zyI2WL0oQLMdzLrWG33Sw/SVTuYIKANgqEp8m:YL79P9pzyI2WLkMdzhKgYIKANgqESm
MD5:	9F5855DCDE72348C0897DFC34A4F5CBD
SHA1:	21DA357B4CF539BA00AFCD8609BBA6DDE4BE3838
SHA-256:	AF69F3BBF0A02E22BC6626F3487BF0FAEE327AD231DC92D10F4A770A93FF9283
SHA-512:	D13AA2BBCC8C660BEBDF799D847FA6F11E745AD35478CFEA25315F89C9D12EF1CE536437311215CDCA9459EEE7805688490C1295059E13E5FEFA601CAB304E45
Malicious:	false
Yara Hits:	Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A1.tmp.dmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A1.tmp.dmp, Author: unknown
Reputation:	low
Preview:	MDMP..a..... ..........f........................................,S..........T.......8...........T...........x...l...........P...........<...............................................................................eJ..............Lw......................T.......l...p..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD55D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8900
Entropy (8bit):	3.7051605883814895
Encrypted:	false
SSDEEP:	192:R6l7wVeJcrcW6YWHnHgmfVKpDRC89b0Khfp8m:R6lXJwF6YWHgmfVM70sfH
MD5:	5D41606B29596162C7547EDE66C2578E
SHA1:	208CE0C9CBF0874B787E6FB33868FB208C523E0F
SHA-256:	809991094687292C33846FB0FF2FE3C10BEDF6AB3DA3CF76A456FDFF2BDB41F9
SHA-512:	54F719EE081FA5A11C9EEB8B5BD996221669A66FCC6DFC392D1F26821D0B0CF11C1CAC5A7D05A4F7FC875DA5EC51F70E12CB097B127FF71CE4003CC76A76F1A1
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD58D.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4800
Entropy (8bit):	4.486190742345975
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg771I9NKWpW8VYbYm8M4JK6jO1FwIyq8vG6jOETxad:uIjfuI7er7VrJKspIWGs7Txad
MD5:	94801AD72870315E7B96C45FCCEF89F9
SHA1:	BDB021A0FDCABE4CD33C6F06F40D39B43D49D8E7
SHA-256:	3AF7AB665948F456EF9346A257D2C3174233731004449529FC869D7574A738F3
SHA-512:	EC930E0A0C0DF17AC2D72CAFA5398329D0043A790B743A8750EDE696933EBE5B537C1151DD8F96F748C26C241FCAF2BE128BD7625AE80BA59E8BAD1994707715
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="493918" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.296029237847674
Encrypted:	false
SSDEEP:	6144:M41fWRYkg7Di2vXoy00lWZgiWaaKxC44Q0NbuDs+BZmBMZJh1Vj7:h1/YCW2AoQ0NiTZwMHrVn
MD5:	234E6DA82807FAF6AD944FD63F220CA8
SHA1:	3D802FB9D7FAF85F51549C9F2B2ADB0B63524F65
SHA-256:	1418917B81A5382569AEFBBAF1118F388CB7372797A063269920783C95FA4DC9
SHA-512:	FCD571398FA649C687DCCA75840A10FFF4923EC9F0516D9829E5C5FBC1C6E22C6BC4D6D2FD877F71CCE23B9B71B45ED91A82F77EE4944EF58F42E2907165EBC2
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmZ.D@_.................................................................................................................................................................................................................................................................................................................................................Pt........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.5071715281779605
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TEiot52yrz.exe
File size:	53'760 bytes
MD5:	fa332de9a0e7da5e975173ee47246172
SHA1:	c6e74c68a11a9d318137aba895f2bcde89d42f2b
SHA256:	915cc233f5c3b36f2aa5a9a0aa2fcd28b8ee406e42c08b71177dab901c219d41
SHA512:	d929f944ebf93719ff6762bcfc56927a29418d71f72636be72b443f6c7d1e04dc6de6e56f8077e2c435f0d7afedf511e99c5768083c243f5f763587ec4158546
SSDEEP:	1536:zli07qgtT9e0uLwwpX996H810S4oqiedINb:zli07qgtg0uLwwp6HGgGb
TLSH:	F633394BEB5256F4F0BBE234C1A2B23BF9F139A45631AB0F96D555030B22770A43E749
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:n6\[.e\[.e\[.eU#.eP[.e...dX[.e...dV[.e...dG[.e...dZ[.e.#.dY[.e\[.e.[.eO..d_[.eO..d][.eRich\[.e........................PE..d..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400032f8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66758E29 [Fri Jun 21 14:28:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	bd1e68ad73a2d648185022e899d7f29c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FB5413038A8h
dec eax
add esp, 28h
jmp 00007FB5413031A7h
int3
int3
jmp 00007FB541303ADEh
int3
int3
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [00005090h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00005075h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FB541303307h
dec eax
lea edx, dword ptr [000099EFh]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FB5413039FAh
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FB54130123Bh
dec eax
lea edx, dword ptr [00009A9Fh]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007FB5413039DAh
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push ebp
push edi
inc ecx
push esi
dec eax
mov ebp, esp
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc esp
mov edx, edx
inc ecx
xor edx, 49656E69h
inc ecx
xor eax, 6C65746Eh
inc esp
mov ecx, ebx
inc esp
mov esi, eax
xor ecx, ecx
mov eax, 00000001h
cpuid
inc ebp
or edx, eax
mov dword ptr [ebp-10h], eax
inc ecx
xor ecx, 756E6547h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xce24	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xf000	0x630	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0x6c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc2f0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xc1b0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6432	0x6600	8759b1b67f2b54eac6557e9c4522457e	False	0.36278339460784315	Macintosh HFS Extended version -16056 data (mounted) last mounted by: 'H\20', created: Fri Aug 26 02:24:04 2078, last modified: Sun Mar 11 23:42:58 2057, last backup: Mon Dec 18 02:10:29 2028, block size: -1064976267, number of blocks: -616002748, free blocks: 609241227	5.60729868940022	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x5b70	0x5c00	7092854450d6513858403ce1ddf23e97	False	0.6414741847826086	data	7.175727936294308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe000	0x7a0	0x200	a762b3a5c773f37ff67e8e610aabbdce	False	0.251953125	DOS executable (block device driver)	2.236712118068703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xf000	0x630	0x800	200a12bd55e0318e3d7585101f49e6d3	False	0.3828125	data	3.4957689526148887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x6c	0x200	7068c81aba75ebf8f944a190333902ff	False	0.220703125	data	1.3343316886712333	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, GetModuleHandleW, IsDebuggerPresent, LoadLibraryA, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, InitializeSListHead, IsProcessorFeaturePresent, VirtualProtect
MSVCP140.dll	?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ, ?flags@ios_base@std@@QEBAHXZ, ?width@ios_base@std@@QEBA_JXZ, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ, ?uncaught_exception@std@@YA_NXZ, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?width@ios_base@std@@QEAA_J_J@Z, ?_Xlength_error@std@@YAXPEBD@Z, ?good@ios_base@std@@QEBA_NXZ
CRYPT32.dll	CertEnumSystemStore
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	memcpy, __std_exception_destroy, __std_exception_copy, memchr, memset, __C_specific_handler, _CxxThrowException, __current_exception, __current_exception_context
api-ms-win-crt-string-l1-1-0.dll	isalnum, strlen
api-ms-win-crt-runtime-l1-1-0.dll	_c_exit, _register_thread_local_exe_atexit_callback, __p___argv, _get_initial_narrow_environment, terminate, _register_onexit_function, _exit, exit, _crt_atexit, _initialize_narrow_environment, _initterm, _configure_narrow_argv, _set_app_type, _initterm_e, _invalid_parameter_noinfo_noreturn, _cexit, __p___argc, _seh_filter_exe, _initialize_onexit_table
api-ms-win-crt-heap-l1-1-0.dll	malloc, free, _set_new_mode, _callnewh
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	__p__commode, _set_fmode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-10T10:55:16.172006+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.10	49707	116.198.231.169	63222	TCP
2024-09-10T10:55:20.852883+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.10	49710	116.198.231.169	63222	TCP
2024-09-10T10:55:25.060105+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.10	49713	116.198.231.169	63222	TCP
2024-09-10T10:55:29.314528+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.10	49716	116.198.231.169	63222	TCP
2024-09-10T10:55:33.550685+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.10	49723	116.198.231.169	63222	TCP
2024-09-10T10:55:37.934760+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.10	49726	116.198.231.169	63222	TCP
2024-09-10T10:55:42.196559+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.10	49729	116.198.231.169	63222	TCP
2024-09-10T10:55:46.376638+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.10	49732	116.198.231.169	63222	TCP
2024-09-10T10:55:50.479481+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.10	49735	116.198.231.169	63222	TCP
2024-09-10T10:55:55.331575+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.10	49738	116.198.231.169	63222	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 10, 2024 10:55:14.107218981 CEST	49707	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:14.112708092 CEST	63222	49707	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:14.112781048 CEST	49707	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:14.141244888 CEST	49707	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:14.146311998 CEST	63222	49707	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:16.171864033 CEST	63222	49707	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:16.172005892 CEST	49707	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:16.172168016 CEST	49707	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:16.172765017 CEST	49708	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:16.176930904 CEST	63222	49707	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:16.177572012 CEST	63222	49708	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:16.177654982 CEST	49708	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:16.177850962 CEST	49708	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:16.183046103 CEST	63222	49708	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:18.191905975 CEST	63222	49708	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:18.192025900 CEST	49708	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:18.192118883 CEST	49708	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:18.192612886 CEST	49709	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:18.198218107 CEST	63222	49708	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:18.198230028 CEST	63222	49709	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:18.198312998 CEST	49709	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:18.198410034 CEST	49709	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:18.203975916 CEST	63222	49709	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:18.204049110 CEST	49709	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:18.218803883 CEST	49710	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:18.223695040 CEST	63222	49710	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:18.223774910 CEST	49710	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:18.224076986 CEST	49710	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:18.229053974 CEST	63222	49710	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:20.852694035 CEST	63222	49710	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:20.852883101 CEST	49710	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:20.852997065 CEST	63222	49710	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:20.853046894 CEST	49710	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:20.853245020 CEST	49710	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:20.853584051 CEST	63222	49710	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:20.853636980 CEST	49710	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:20.857814074 CEST	49711	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:20.858282089 CEST	63222	49710	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:20.862652063 CEST	63222	49711	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:20.862740993 CEST	49711	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:20.863157988 CEST	49711	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:20.867934942 CEST	63222	49711	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:22.862358093 CEST	63222	49711	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:22.862431049 CEST	49711	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:22.862577915 CEST	49711	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:22.865911961 CEST	49712	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:22.867328882 CEST	63222	49711	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:22.870815992 CEST	63222	49712	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:22.870922089 CEST	49712	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:22.871078968 CEST	49712	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:22.872808933 CEST	49713	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:22.876404047 CEST	63222	49712	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:22.876508951 CEST	49712	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:22.877717018 CEST	63222	49713	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:22.877803087 CEST	49713	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:22.878231049 CEST	49713	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:22.883008957 CEST	63222	49713	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:25.059993982 CEST	63222	49713	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:25.060105085 CEST	49713	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:25.060364008 CEST	49713	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:25.062691927 CEST	49714	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:25.065248013 CEST	63222	49713	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:25.067728043 CEST	63222	49714	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:25.067926884 CEST	49714	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:25.068355083 CEST	49714	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:25.077413082 CEST	63222	49714	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:27.125807047 CEST	63222	49714	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:27.125916004 CEST	49714	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:27.126012087 CEST	49714	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:27.129204988 CEST	49715	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:27.130753994 CEST	63222	49714	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:27.134063005 CEST	63222	49715	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:27.134162903 CEST	49715	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:27.134314060 CEST	49715	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:27.138617039 CEST	49716	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:27.139235973 CEST	63222	49715	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:27.139308929 CEST	49715	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:27.143495083 CEST	63222	49716	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:27.143596888 CEST	49716	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:27.143879890 CEST	49716	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:27.148644924 CEST	63222	49716	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:29.314465046 CEST	63222	49716	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:29.314527988 CEST	49716	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:29.314945936 CEST	49716	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:29.319788933 CEST	63222	49716	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:29.325774908 CEST	49718	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:29.330698967 CEST	63222	49718	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:29.330779076 CEST	49718	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:29.331099987 CEST	49718	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:29.335912943 CEST	63222	49718	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:31.466381073 CEST	63222	49718	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:31.466599941 CEST	49718	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:31.466599941 CEST	49718	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:31.471355915 CEST	49722	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:31.471518993 CEST	63222	49718	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:31.476197004 CEST	63222	49722	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:31.476330996 CEST	49722	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:31.476500988 CEST	49722	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:31.478465080 CEST	49723	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:31.481384039 CEST	63222	49722	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:31.481442928 CEST	49722	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:31.483342886 CEST	63222	49723	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:31.483499050 CEST	49723	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:31.483824015 CEST	49723	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:31.488581896 CEST	63222	49723	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:33.550565004 CEST	63222	49723	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:33.550684929 CEST	49723	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:33.550775051 CEST	49723	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:33.555533886 CEST	63222	49723	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:33.556050062 CEST	49724	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:33.561026096 CEST	63222	49724	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:33.561218023 CEST	49724	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:33.561517000 CEST	49724	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:33.566266060 CEST	63222	49724	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:35.802422047 CEST	63222	49724	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:35.802494049 CEST	49724	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:35.802572966 CEST	49724	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:35.805840015 CEST	49725	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:35.807400942 CEST	63222	49724	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:35.810615063 CEST	63222	49725	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:35.810683966 CEST	49725	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:35.810805082 CEST	49725	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:35.811948061 CEST	49726	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:35.815834999 CEST	63222	49725	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:35.815891027 CEST	49725	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:35.816706896 CEST	63222	49726	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:35.816771030 CEST	49726	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:35.817068100 CEST	49726	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:35.821822882 CEST	63222	49726	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:37.934530973 CEST	63222	49726	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:37.934760094 CEST	49726	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:37.934761047 CEST	49726	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:37.939683914 CEST	63222	49726	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:37.941485882 CEST	49727	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:37.946393013 CEST	63222	49727	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:37.946508884 CEST	49727	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:37.946794987 CEST	49727	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:37.951602936 CEST	63222	49727	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:40.066704988 CEST	63222	49727	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:40.066812992 CEST	49727	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:40.066947937 CEST	49727	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:40.072145939 CEST	49728	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:40.073117971 CEST	63222	49727	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:40.078517914 CEST	63222	49728	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:40.078619957 CEST	49728	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:40.078756094 CEST	49728	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:40.081856012 CEST	49729	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:40.085452080 CEST	63222	49728	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:40.085524082 CEST	49728	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:40.088115931 CEST	63222	49729	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:40.088202000 CEST	49729	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:40.088496923 CEST	49729	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:40.094705105 CEST	63222	49729	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:42.196346045 CEST	63222	49729	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:42.196558952 CEST	49729	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:42.196975946 CEST	49729	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:42.201561928 CEST	49730	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:42.201890945 CEST	63222	49729	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:42.206602097 CEST	63222	49730	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:42.206681013 CEST	49730	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:42.206969976 CEST	49730	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:42.212064028 CEST	63222	49730	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:44.201756954 CEST	63222	49730	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:44.201911926 CEST	49730	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:44.201999903 CEST	49730	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:44.207027912 CEST	63222	49730	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:44.210915089 CEST	49731	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:44.215935946 CEST	63222	49731	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:44.216095924 CEST	49731	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:44.216175079 CEST	49731	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:44.217467070 CEST	49732	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:44.221604109 CEST	63222	49731	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:44.221687078 CEST	49731	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:44.222548008 CEST	63222	49732	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:44.222623110 CEST	49732	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:44.222887039 CEST	49732	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:44.227749109 CEST	63222	49732	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:46.376059055 CEST	63222	49732	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:46.376637936 CEST	49732	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:46.376637936 CEST	49732	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:46.382811069 CEST	63222	49732	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:46.383532047 CEST	49733	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:46.389769077 CEST	63222	49733	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:46.389862061 CEST	49733	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:46.390222073 CEST	49733	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:46.396368027 CEST	63222	49733	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:48.434499979 CEST	63222	49733	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:48.434614897 CEST	49733	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:48.434731960 CEST	49733	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:48.439851999 CEST	63222	49733	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:48.441770077 CEST	49734	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:48.446651936 CEST	63222	49734	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:48.446768045 CEST	49734	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:48.446841002 CEST	49734	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:48.448101997 CEST	49735	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:48.451955080 CEST	63222	49734	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:48.452028036 CEST	49734	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:48.452997923 CEST	63222	49735	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:48.453072071 CEST	49735	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:48.453399897 CEST	49735	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:48.458323002 CEST	63222	49735	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:50.479345083 CEST	63222	49735	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:50.479480982 CEST	49735	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:50.479626894 CEST	49735	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:50.483727932 CEST	49736	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:50.484613895 CEST	63222	49735	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:50.488636017 CEST	63222	49736	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:50.488727093 CEST	49736	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:50.489017010 CEST	49736	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:50.493879080 CEST	63222	49736	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:52.530267000 CEST	63222	49736	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:52.530394077 CEST	49736	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:52.530488968 CEST	49736	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:52.534614086 CEST	49737	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:52.536649942 CEST	63222	49736	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:52.540513992 CEST	63222	49737	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:52.540601015 CEST	49737	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:52.540818930 CEST	49737	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:52.543648958 CEST	49738	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:52.546797991 CEST	63222	49737	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:52.546860933 CEST	49737	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:52.549560070 CEST	63222	49738	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:52.549798012 CEST	49738	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:52.550087929 CEST	49738	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:52.555913925 CEST	63222	49738	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:55.331469059 CEST	63222	49738	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:55.331574917 CEST	49738	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:55.331747055 CEST	63222	49738	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:55.331820011 CEST	49738	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:55.331820011 CEST	49738	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:55.332000017 CEST	63222	49738	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:55.332042933 CEST	49738	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:55.338206053 CEST	63222	49738	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:55.344966888 CEST	49739	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:55.354830980 CEST	63222	49739	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:55.354918957 CEST	49739	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:55.355288982 CEST	49739	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:55.361598969 CEST	63222	49739	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:57.411556005 CEST	63222	49739	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:57.411704063 CEST	49739	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:57.411782980 CEST	49739	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:57.415911913 CEST	49740	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:57.416640997 CEST	63222	49739	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:57.421608925 CEST	63222	49740	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:57.421681881 CEST	49740	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:57.421765089 CEST	49740	63222	192.168.2.10	116.198.231.169
Sep 10, 2024 10:55:57.426899910 CEST	63222	49740	116.198.231.169	192.168.2.10
Sep 10, 2024 10:55:57.426961899 CEST	49740	63222	192.168.2.10	116.198.231.169

Target ID:	7
Start time:	04:55:12
Start date:	10/09/2024
Path:	C:\Users\user\Desktop\TEiot52yrz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\TEiot52yrz.exe"
Imagebase:	0x7ff6e7f50000
File size:	53'760 bytes
MD5 hash:	FA332DE9A0E7DA5E975173EE47246172
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:55:57
Start date:	10/09/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7788 -s 1192
Imagebase:	0x7ff6f9aa0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	9%
Total number of Nodes:	376
Total number of Limit Nodes:	1

Executed Functions

Function 00000076FB5BE122 Relevance: 6.6, APIs: 2, Strings: 1, Instructions: 1335
librarynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000076FB5BE13D
InternetOpenA.WININET(00000000,00000000), ref: 00000076FB5BE155

Strings

wini, xrefs: 00000076FB5BE126

Memory Dump Source

Source File: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, Offset: 00000076FB5BE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_76fb5be000_TEiot52yrz.jbxd

Yara matches

Similarity

API ID: InternetLibraryLoadOpen
String ID: wini
API String ID: 2559873147-1606035523
Opcode ID: 51c54267f9cd2cca7edefae26dac4bc1127b3a3d473d53d62c89283203456324
Instruction ID: b6e83d95d97e127da1a5af8cd89b931c09583ea484ce94ab12e89b991048bcef
Opcode Fuzzy Hash: 51c54267f9cd2cca7edefae26dac4bc1127b3a3d473d53d62c89283203456324
Instruction Fuzzy Hash: D07283714097D1AEEBA39F78D054243BFA0BF4B714BAA18FDD8C25F023C265A842D752

Function 00007FF6E7F56AFC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 99
librarymemoryencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E7F56CC0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6E7F56D51
Part of subcall function 00007FF6E7F56CC0: memcpy.VCRUNTIME140 ref: 00007FF6E7F56D66
Part of subcall function 00007FF6E7F56CC0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6E7F56DAA
Part of subcall function 00007FF6E7F56CC0: memcpy.VCRUNTIME140 ref: 00007FF6E7F56DC2

LoadLibraryA.KERNEL32 ref: 00007FF6E7F56C50
VirtualProtect.KERNELBASE ref: 00007FF6E7F56C73
CertEnumSystemStore.CRYPT32 ref: 00007FF6E7F56C8B

Strings

fTk0IXs+RsZrY9epOUeq1oQ0l4RoVPjlVJoEuMX3zPeE+je8GdHrJUcxFZpepdr4SDRVKa6s7ouAvVNOqjbmDXauHJGPlOuvClVpjZvRyLdC2d6h5WF7twqC1kX9nIKWgL9KaawEYPrhgpcPJeSSnLatPbvLnYxgng2QCJQ8DmxkwRBosnzlWeW39pnWOJcwZvMht1Ue7ys35aku9WPa2jr1RTE8qRhrprEAHTM+xpPpcOmcTSt4aUDyEbOtWv6EV/1G, xrefs: 00007FF6E7F56B2E
W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu, xrefs: 00007FF6E7F56B4A
kernel32.dll, xrefs: 00007FF6E7F56C49
W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu, xrefs: 00007FF6E7F56B66

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorkmemcpy$CertEnumLibraryLoadProtectStoreSystemVirtual
String ID: W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu$W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu$fTk0IXs+RsZrY9epOUeq1oQ0l4RoVPjlVJoEuMX3zPeE+je8GdHrJUcxFZpepdr4SDRVKa6s7ouAvVNOqjbmDXauHJGPlOuvClVpjZvRyLdC2d6h5WF7twqC1kX9nIKWgL9KaawEYPrhgpcPJeSSnLatPbvLnYxgng2QCJQ8DmxkwRBosnzlWeW39pnWOJcwZvMht1Ue7ys35aku9WPa2jr1RTE8qRhrprEAHTM+xpPpcOmcTSt4aUDyEbOtWv6EV/1G$kernel32.dll
API String ID: 1274391132-1474288648
Opcode ID: 0021a513d3075bfe4559da1246eef3f31aed97dd76e4d3ed1e31a3c18aea7553
Instruction ID: 7e5ecc4ec3c9f7eeb78fc1253cd10e301f25435bcd77f967224243835bb39d3b
Opcode Fuzzy Hash: 0021a513d3075bfe4559da1246eef3f31aed97dd76e4d3ed1e31a3c18aea7553
Instruction Fuzzy Hash: 8941452260CAC695DA60DB54F4503EB67A1FBC8784F804132E69EC3BA9EF3DD945CB05

Function 00007FF6E7F5317C Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6E7F531A5
__scrt_release_startup_lock.LIBCMT ref: 00007FF6E7F53213
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6E7F53261
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6E7F53266
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6E7F5326E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6E7F53276
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6E7F53298
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6E7F532F2

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: b8b73077751ae62d481563376bd79326efdf3318ec70507a033230f709591385
Instruction ID: a9960a6cafa6ce489f0cbbffbfa9cd89311470c6815504c8adaf298628236423
Opcode Fuzzy Hash: b8b73077751ae62d481563376bd79326efdf3318ec70507a033230f709591385
Instruction Fuzzy Hash: DE313A23E0C50382FA14AB69F4513F92291AF45788F44C534EA7EC76D7DE2FAC05824B

Function 00000076FB5BE17B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpOpenRequestA.WININET(00000000,00000000,84C03200,00000000), ref: 00000076FB5BE196

Strings

U.;, xrefs: 00000076FB5BE191

Memory Dump Source

Source File: 00000007.00000002.1771906385.00000076FB5BE000.00000040.00000010.00020000.00000000.sdmp, Offset: 00000076FB5BE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_76fb5be000_TEiot52yrz.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: U.;
API String ID: 1984915467-4213443877
Opcode ID: ab09341529980e95ac1e803047b3985bc20a26ea9b837d55d995e7e224907264
Instruction ID: 61e1a4f195e225146181d8f93f0068da1b1798b9e81f6221d893c8736b6301f2
Opcode Fuzzy Hash: ab09341529980e95ac1e803047b3985bc20a26ea9b837d55d995e7e224907264
Instruction Fuzzy Hash: 5E118BA134890D1BF62885AEBC6A73A21CAD7D8765F24823FF50FC32D6DC58DC82415A

Non-executed Functions

Function 00007FF6E7F5365C Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6E7F53678
memset.VCRUNTIME140 ref: 00007FF6E7F5369C
RtlCaptureContext.KERNEL32 ref: 00007FF6E7F536A5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6E7F536BF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6E7F53700
memset.VCRUNTIME140 ref: 00007FF6E7F53733
IsDebuggerPresent.KERNEL32 ref: 00007FF6E7F53754
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E7F53771
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6E7F5377C

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 7335fbb8426a945ac828c7077c8e300b3c8bd9ec95d4022230abd3d7a7f75a14
Instruction ID: dc9eb2fd3954754e4712f399f12f5c0bc1c3fdfe96a0541ac67dbf88a95c97f8
Opcode Fuzzy Hash: 7335fbb8426a945ac828c7077c8e300b3c8bd9ec95d4022230abd3d7a7f75a14
Instruction Fuzzy Hash: 3C314F73609B818AEB608F64F8407ED73A4FB85748F44803ADA5E87B98DF39D948C715

Function 00007FF6E7F53DE8 Relevance: 6.6, APIs: 2, Strings: 2, Instructions: 581
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FF6E7F53E4A
, xrefs: 00007FF6E7F53E27

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: d8bd270e9d87edd875d7f9d873967e908e7bfa0f1dd1a07bdc383474c52699a2
Instruction ID: cd5760c77a9fcc3ca2cd30ccf2c5bc8e3996e8ee49573ff5c078b52ffdab0aa4
Opcode Fuzzy Hash: d8bd270e9d87edd875d7f9d873967e908e7bfa0f1dd1a07bdc383474c52699a2
Instruction Fuzzy Hash: A852D873609A81CAD774CB19E4807AAB7A1F7C8749F148226E69E87B58CB3DD941CF04

Function 00007FF6E7F53874 Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6E7F538A0
GetCurrentThreadId.KERNEL32 ref: 00007FF6E7F538AE
GetCurrentProcessId.KERNEL32 ref: 00007FF6E7F538BA
QueryPerformanceCounter.KERNEL32 ref: 00007FF6E7F538CA

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9b69f90bbb091b32707effc177f545cd80205cc59f5ac2c3711d41dd0f4641bd
Instruction ID: 66bc197977d115f613d086751219e7a8c7e42462759972f6f73a81c5cbbb6605
Opcode Fuzzy Hash: 9b69f90bbb091b32707effc177f545cd80205cc59f5ac2c3711d41dd0f4641bd
Instruction Fuzzy Hash: 1A111526B14F068AEB008F60F8553E933A4FB19768F440E31EA6D877A4DF78D9988341

Function 00007FF6E7F55D5C Relevance: .6, Instructions: 556COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a46b35d7a26a7fb26f39faf249998ab39fdfcee5fcf209b6738682e87834f0
Instruction ID: 2b3c5ee1f005e6341e253377bbbe4921fd3e8fc43b1fe84c9ebb8b08ccebe817
Opcode Fuzzy Hash: 54a46b35d7a26a7fb26f39faf249998ab39fdfcee5fcf209b6738682e87834f0
Instruction Fuzzy Hash: 3A422C73218A818AD759CB1DF89067ABBA1F7C8791F444126E79EC3B69CE3CD551CB00

Function 00007FF6E7F554A4 Relevance: .6, Instructions: 556COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114221cd8fb83a4d1b3f4e9c07f063070523e9746f19f36e16c9c60b1fbf2ef1
Instruction ID: 0a917e26d70fda762e9c8c0c7790943274901709df8e61cd217934c3f88d8a76
Opcode Fuzzy Hash: 114221cd8fb83a4d1b3f4e9c07f063070523e9746f19f36e16c9c60b1fbf2ef1
Instruction Fuzzy Hash: 07422B7321CA818AD754CB1DF89067ABBA1F7C8785F44412AE69EC3BA9DE3CD551CB00

Function 00007FF6E7F5603A Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92bf19dc8cd86aff032756dfb13700223f95881ed97291965757eed8e9fc06d6
Instruction ID: ef6d5c025ad9472e4eb9e29ad0cc127a81b081427d3b9c6bd2d7bdd671b60e60
Opcode Fuzzy Hash: 92bf19dc8cd86aff032756dfb13700223f95881ed97291965757eed8e9fc06d6
Instruction Fuzzy Hash: D56132B76189418BD724CB18E89077AB3A2FBCC745F458635E35A87A58DB3DEA50CB00

Function 00007FF6E7F55785 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f29163b5e8fdaf0dc49c2304f5fe647261e8bcf9fb33c4e691343a0f95705ad
Instruction ID: 1d011f3a10a8be6967e94940f93122ca1284f0d2bedaa632ac72a4b58ded23a8
Opcode Fuzzy Hash: 4f29163b5e8fdaf0dc49c2304f5fe647261e8bcf9fb33c4e691343a0f95705ad
Instruction Fuzzy Hash: 766140B66189418BD724CF18E49077AB3A2FBC8745F458635E35AC7A58DA3DEA50CB00

Function 00007FF6E7F53804 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b4fbbec666916b0587e8a13de0dadc5ecbb71f9984410eb9ff46545bbfccba
Instruction ID: 8747136f276c71212b4087b169767ba23fe597cc9cc681d7ab1cc14b9586d768
Opcode Fuzzy Hash: 43b4fbbec666916b0587e8a13de0dadc5ecbb71f9984410eb9ff46545bbfccba
Instruction Fuzzy Hash: D8A0022390CC42D0E6088B04F9512B163B0FF50305B45C471C42DC3160DF3EAD55C32B

Function 00007FF6E7F5253C Relevance: 21.2, APIs: 14, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E7F51ABC: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00007FF6E7F515D6,?,?,?,?,?,?,00007FF6E7F51017), ref: 00007FF6E7F51ACA

?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF6E7F52593
?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF6E7F525BE
?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF6E7F525EB
?flags@ios_base@std@@QEBAHXZ.MSVCP140 ref: 00007FF6E7F52664
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP140 ref: 00007FF6E7F526B3
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF6E7F526DA
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6E7F526E9
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF6E7F52743
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF6E7F52759
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP140 ref: 00007FF6E7F527C1
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF6E7F527E8
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6E7F527F7
?width@ios_base@std@@QEAA_J_J@Z.MSVCP140 ref: 00007FF6E7F5284C
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF6E7F5287C

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?width@ios_base@std@@$?rdbuf@?$basic_ios@D@std@@@2@V?$basic_streambuf@$?fill@?$basic_ios@?sputc@?$basic_streambuf@$?flags@ios_base@std@@?setstate@?$basic_ios@?sputn@?$basic_streambuf@strlen
String ID:
API String ID: 207065933-0
Opcode ID: f4bc5cb1901ef092bd8a86ad73b7320c61d8d2db2b875ebc753e22042a0a0f00
Instruction ID: d21aae9a0732601a02cb17cd195283741dd5be05be5d0e1c03e6e03d03e34c42
Opcode Fuzzy Hash: f4bc5cb1901ef092bd8a86ad73b7320c61d8d2db2b875ebc753e22042a0a0f00
Instruction Fuzzy Hash: ABA1FA77A09B8586DA60CB55F4943AAB7A0FBC8B85F008136DA9EC3765DF3DD8048B05

Function 00007FF6E7F56CC0 Relevance: 9.2, APIs: 6, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6E7F56D51
memcpy.VCRUNTIME140 ref: 00007FF6E7F56D66
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6E7F56DAA
memcpy.VCRUNTIME140 ref: 00007FF6E7F56DC2
memset.VCRUNTIME140 ref: 00007FF6E7F56EC5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF6E7F56EE8

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredV01@Workmemcpy$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@@memset
String ID:
API String ID: 2816322446-0
Opcode ID: b9c5c220a8161afe00995a3b5838346bc2764bb80acdb38bfd23fd1c6c53baac
Instruction ID: d54acce9ce0b379d38fe1b93c7ca1a507cf4b59dc8db63bf6626b12064984aba
Opcode Fuzzy Hash: b9c5c220a8161afe00995a3b5838346bc2764bb80acdb38bfd23fd1c6c53baac
Instruction Fuzzy Hash: 55813A3361DA8585DA60DB15F8903AEB7A0FBC5780F109026EA9E83B69DF3DD844CB05

Function 00007FF6E7F52968 Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E7F52A98: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140(?,?,?,?,?,?,00007FF6E7F52985), ref: 00007FF6E7F52ADA

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6E7F529A0
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF6E7F529D2

Memory Dump Source

Source File: 00000007.00000002.1772890159.00007FF6E7F51000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6E7F50000, based on PE: true

Associated: 00000007.00000002.1772838031.00007FF6E7F50000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772907807.00007FF6E7F58000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772929218.00007FF6E7F5E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1772944075.00007FF6E7F5F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6e7f50000_TEiot52yrz.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@2@D@std@@@std@@$?good@ios_base@std@@?rdbuf@?$basic_ios@?tie@?$basic_ios@V?$basic_ostream@V?$basic_streambuf@
String ID:
API String ID: 3792166412-0
Opcode ID: 61c6c2cae3a07f63e2bf5b4d9e59194abfd40384aa0aa098eae079579a8cfedb
Instruction ID: 08232a670e9bf9a499e9dc7f93cc496125d90849811b1374eacfeb759eb8ac4d
Opcode Fuzzy Hash: 61c6c2cae3a07f63e2bf5b4d9e59194abfd40384aa0aa098eae079579a8cfedb
Instruction Fuzzy Hash: 3421EC2760DB8581DA10CB4AF494369A7B0FBC9B94F508125EF8E83724DF3ED8409705

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TEiot52yrz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Threatname: Metasploit

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_TEiot52yrz.exe_d23f16c97e88e178369da9a9b73acf7cc86966_8fd4efbb_14680be6-56b5-4a96-a3b1-60837cf7e648\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A1.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD55D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD58D.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
TEiot52yrz.exe

Function 00000076FB5BE122 Relevance: 6.6, APIs: 2, Strings: 1, Instructions: 1335
librarynetworkCOMMON

Function 00007FF6E7F56AFC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 99
librarymemoryencryptionCOMMON

Function 00007FF6E7F5317C Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Function 00000076FB5BE17B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99
networkCOMMON

Function 00007FF6E7F5365C Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Function 00007FF6E7F53DE8 Relevance: 6.6, APIs: 2, Strings: 2, Instructions: 581
COMMON

Function 00007FF6E7F53874 Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMON

Function 00007FF6E7F5253C Relevance: 21.2, APIs: 14, Instructions: 201
COMMON

Function 00007FF6E7F56CC0 Relevance: 9.2, APIs: 6, Instructions: 166
COMMON

Function 00007FF6E7F52968 Relevance: 6.1, APIs: 4, Instructions: 53
COMMON