Edit tour

Windows Analysis Report
TEiot52yrz.exe

Overview

General Information

Sample name:	TEiot52yrz.exe renamed because original name is a hash value
Original sample name:	915cc233f5c3b36f2aa5a9a0aa2fcd28b8ee406e42c08b71177dab901c219d41.exe
Analysis ID:	1508525
MD5:	fa332de9a0e7da5e975173ee47246172
SHA1:	c6e74c68a11a9d318137aba895f2bcde89d42f2b
SHA256:	915cc233f5c3b36f2aa5a9a0aa2fcd28b8ee406e42c08b71177dab901c219d41
Tags:	116-198-231-169exe
Infos:

Detection

CobaltStrike, Metasploit

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected Metasploit Payload

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

TEiot52yrz.exe (PID: 6740 cmdline: "C:\Users\user\Desktop\TEiot52yrz.exe" MD5: FA332DE9A0E7DA5E975173EE47246172)

WerFault.exe (PID: 5092 cmdline: C:\Windows\system32\WerFault.exe -u -p 6740 -s 1100 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"C2Server": "http://116.198.231.169:63222/jquery-3.3.2.slim.min.js", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n"}

Threatname: Metasploit

{"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://code.jquery.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://116.198.231.169/jquery-3.3.2.slim.min.js"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Microsoft\Windows\WER\Temp\WER319B.tmp.dmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x1a349:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
C:\ProgramData\Microsoft\Windows\WER\Temp\WER319B.tmp.dmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x1a3b5:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x131:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x19d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-10T10:59:46.099185+0200	2028765	3	Unknown Traffic	192.168.2.7	49699	116.198.231.169	63222	TCP
2024-09-10T10:59:50.318619+0200	2028765	3	Unknown Traffic	192.168.2.7	49702	116.198.231.169	63222	TCP
2024-09-10T10:59:54.697952+0200	2028765	3	Unknown Traffic	192.168.2.7	49705	116.198.231.169	63222	TCP
2024-09-10T10:59:59.017704+0200	2028765	3	Unknown Traffic	192.168.2.7	49708	116.198.231.169	63222	TCP
2024-09-10T11:00:03.146814+0200	2028765	3	Unknown Traffic	192.168.2.7	49713	116.198.231.169	63222	TCP
2024-09-10T11:00:07.587572+0200	2028765	3	Unknown Traffic	192.168.2.7	49718	116.198.231.169	63222	TCP
2024-09-10T11:00:11.860949+0200	2028765	3	Unknown Traffic	192.168.2.7	49721	116.198.231.169	63222	TCP
2024-09-10T11:00:16.128098+0200	2028765	3	Unknown Traffic	192.168.2.7	49724	116.198.231.169	63222	TCP
2024-09-10T11:00:20.591162+0200	2028765	3	Unknown Traffic	192.168.2.7	49727	116.198.231.169	63222	TCP
2024-09-10T11:00:25.056689+0200	2028765	3	Unknown Traffic	192.168.2.7	49730	116.198.231.169	63222	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: TEiot52yrz.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp	Malware Configuration Extractor: CobaltStrike {"C2Server": "http://116.198.231.169:63222/jquery-3.3.2.slim.min.js", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n"}
Source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp	Malware Configuration Extractor: Metasploit {"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://code.jquery.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\r\n", "Type": "Metasploit Download", "URL": "http://116.198.231.169/jquery-3.3.2.slim.min.js"}

Multi AV Scanner detection for submitted file

Source: TEiot52yrz.exe	ReversingLabs: Detection: 60%
Source: TEiot52yrz.exe	Virustotal: Detection: 60%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 82.1% probability

Source: TEiot52yrz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://116.198.231.169:63222/jquery-3.3.2.slim.min.js
Source: Malware configuration extractor	URLs: http://116.198.231.169/jquery-3.3.2.slim.min.js

Source: global traffic

TCP traffic: 192.168.2.7:49699 -> 116.198.231.169:63222

Source: Joe Sandbox View

IP Address: 116.198.231.169 116.198.231.169

Source: Joe Sandbox View

ASN Name: CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49699 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49702 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49708 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49705 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49721 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49713 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49718 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49727 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49724 -> 116.198.231.169:63222
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49730 -> 116.198.231.169:63222

Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169
Source: unknown	TCP traffic detected without corresponding DNS query: 116.198.231.169

Source: TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1591223618.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1636439563.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1615500987.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550406186.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1681843568.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1528198264.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1570868288.0000021B45724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/
Source: TEiot52yrz.exe, 00000000.00000003.1660155451.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1636439563.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1615500987.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1681843568.0000021B45724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/B
Source: TEiot52yrz.exe, 00000000.00000003.1636439563.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1615500987.0000021B45724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/G
Source: TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/SioE
Source: TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/V
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net
Source: TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B45706000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B45706000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B45706000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169/
Source: TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B45706000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B45706000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B45706000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169/Gl4
Source: TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/
Source: TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/$
Source: TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/O
Source: TEiot52yrz.exe, 00000000.00000002.2172633122.0000021B4569C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.js
Source: TEiot52yrz.exe, 00000000.00000002.2172633122.0000021B4569C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsr
Source: TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/l
Source: TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/ntdesk
Source: TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/sk
Source: TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://116.198.231.169:63222/~

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER319B.tmp.dmp, type: DROPPED	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER319B.tmp.dmp, type: DROPPED	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown

Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 0_2_00007FF6295454A4	0_2_00007FF6295454A4
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 0_2_00007FF62954603A	0_2_00007FF62954603A
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 0_2_00007FF629545785	0_2_00007FF629545785
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 0_2_00007FF629545D5C	0_2_00007FF629545D5C
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 0_2_00007FF629543DE8	0_2_00007FF629543DE8

Source: C:\Users\user\Desktop\TEiot52yrz.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6740 -s 1100

Source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER319B.tmp.dmp, type: DROPPED	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER319B.tmp.dmp, type: DROPPED	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23

Source: classification engine

Classification label: mal96.troj.winEXE@2/5@0/1

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6740

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\413ecb78-240d-42c9-acf4-f046fb819b77

Jump to behavior

Source: TEiot52yrz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TEiot52yrz.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TEiot52yrz.exe	ReversingLabs: Detection: 60%
Source: TEiot52yrz.exe	Virustotal: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\TEiot52yrz.exe "C:\Users\user\Desktop\TEiot52yrz.exe"
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6740 -s 1100

Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\TEiot52yrz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: TEiot52yrz.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: TEiot52yrz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: TEiot52yrz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 0_2_000000E1057AE24B push eax; ret		0_2_000000E1057AE4A7
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 0_2_000000E1057AE429 push eax; ret		0_2_000000E1057AE4A7

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B45714000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B45714000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B45714000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc}
Source: Amcache.hve.13.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.13.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B45714000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B45714000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456D5000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B45714000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.13.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.13.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.13.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.13.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\TEiot52yrz.exe

Code function: 0_2_00007FF62954365C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF62954365C

Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 0_2_00007FF62954365C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF62954365C
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 0_2_00007FF629542B74 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF629542B74
Source: C:\Users\user\Desktop\TEiot52yrz.exe	Code function: 0_2_00007FF629543804 SetUnhandledExceptionFilter,	0_2_00007FF629543804

Source: C:\Users\user\Desktop\TEiot52yrz.exe

Code function: 0_2_00007FF629543874 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF629543874

Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: MsMpEng.exe

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match

File source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY

Yara detected Metasploit Payload

Source: Yara match

File source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TEiot52yrz.exe	61%	ReversingLabs	Win64.Backdoor.MeterpreterReverseShell
TEiot52yrz.exe	60%	Virustotal		Browse
TEiot52yrz.exe	100%	Avira	TR/AD.MeterpreterSC.zrtjs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://116.198.231.169:63222/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
http://code.jquery.com/G	0%	Avira URL Cloud	safe
http://code.jquery.com/SioE	0%	Avira URL Cloud	safe
http://code.jquery.com/	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/l	0%	Avira URL Cloud	safe
http://code.jquery.com/	1%	Virustotal		Browse
http://code.jquery.com/G	0%	Virustotal		Browse
https://116.198.231.169:63222/O	0%	Avira URL Cloud	safe
http://code.jquery.com/B	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/$	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/sk	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/	0%	Avira URL Cloud	safe
http://code.jquery.com/B	0%	Virustotal		Browse
https://116.198.231.169:63222/~	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/jquery-3.3.2.slim.min.js	0%	Virustotal		Browse
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsr	0%	Avira URL Cloud	safe
http://code.jquery.com/V	0%	Avira URL Cloud	safe
http://116.198.231.169:63222/jquery-3.3.2.slim.min.js	0%	Virustotal		Browse
https://116.198.231.169:63222/	0%	Virustotal		Browse
https://116.198.231.169/	0%	Avira URL Cloud	safe
https://116.198.231.169:63222/ntdesk	0%	Avira URL Cloud	safe
http://116.198.231.169/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
https://116.198.231.169/	0%	Virustotal		Browse
https://116.198.231.169/Gl4	0%	Avira URL Cloud	safe
http://code.jquery.com/V	0%	Virustotal		Browse
https://116.198.231.169:63222/~	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://116.198.231.169:63222/jquery-3.3.2.slim.min.js	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://116.198.231.169/jquery-3.3.2.slim.min.js	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://116.198.231.169:63222/l	TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/	TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1591223618.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1636439563.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1615500987.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550406186.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1681843568.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1528198264.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1570868288.0000021B45724000.00000004.00000020.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://code.jquery.com/G	TEiot52yrz.exe, 00000000.00000003.1636439563.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1615500987.0000021B45724000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://code.jquery.com/SioE	TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/O	TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/B	TEiot52yrz.exe, 00000000.00000003.1660155451.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1636439563.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1615500987.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B45724000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1681843568.0000021B45724000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/$	TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/sk	TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.js	TEiot52yrz.exe, 00000000.00000002.2172633122.0000021B4569C000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/	TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456D5000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/~	TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.13.dr	false	URL Reputation: safe	unknown
https://116.198.231.169:63222/jquery-3.3.2.slim.min.jsr	TEiot52yrz.exe, 00000000.00000002.2172633122.0000021B4569C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/V	TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456F2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169/	TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B45706000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B45706000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B45706000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://116.198.231.169:63222/ntdesk	TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B456D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://116.198.231.169/Gl4	TEiot52yrz.exe, 00000000.00000003.1660193942.0000021B45706000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000002.2172690846.0000021B45706000.00000004.00000020.00020000.00000000.sdmp, TEiot52yrz.exe, 00000000.00000003.1550425603.0000021B45706000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.198.231.169	unknown	China		137699	CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1508525
Start date and time:	2024-09-10 10:58:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TEiot52yrz.exe renamed because original name is a hash value
Original Sample Name:	915cc233f5c3b36f2aa5a9a0aa2fcd28b8ee406e42c08b71177dab901c219d41.exe
Detection:	MAL
Classification:	mal96.troj.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 57% Number of executed functions: 3 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
116.198.231.169	LtmV2sDcTK.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	QT2hJT3Syn.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	2PSj0qX4W6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	LtmV2sDcTK.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	QT2hJT3Syn.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINATELECOM-JIANGSU-SUQIAN-IDCCHINATELECOMJiangsuSuqian	LtmV2sDcTK.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	QT2hJT3Syn.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	2PSj0qX4W6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	LtmV2sDcTK.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	QT2hJT3Syn.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.198.231.169
	gOEF4WOJ3c.elf	Get hash	malicious	Unknown	Browse	116.198.238.210

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_TEiot52yrz.exe_2714b4b2d07e7c82202e7568b15aa71dbc91f2_8fd4efbb_65b56a23-ade3-47d4-9527-560feaa0e927\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9251117719939682
Encrypted:	false
SSDEEP:	96:08KFch54fs4hqKeoh7Ru6NbQXIDcQWc6zcEZcw37diG+HbHg/JgWlB8sKa9bATFd:y2hGfUn0I3D8jcoTzuiFQZ24lO81
MD5:	EF451BBBC610FAB97E4FDF3A69CF34C5
SHA1:	6A646600AE3CECA3337AAEC63F4FBB113AF51050
SHA-256:	666C47B30C8EA3C832A9FE7ECB6D7313AEB05C29B844E853D40CD3BA98D7683F
SHA-512:	4ED4FB5108145102075C5ACE2BF7217DB2C5EAFB7D36E1CD1155899D5D4C2396485AC0C2483BDC05ADA5938F3C994564C27181D4D0AAAE5C11FEB098FF7597B4
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.4.3.9.2.1.7.3.0.5.4.9.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.4.3.9.2.1.7.6.1.7.9.3.9.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.5.b.5.6.a.2.3.-.a.d.e.3.-.4.7.d.4.-.9.5.2.7.-.5.6.0.f.e.a.a.0.e.9.2.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.e.d.b.9.3.4.2.-.1.d.4.d.-.4.b.4.8.-.8.d.f.c.-.1.a.5.0.7.1.f.6.5.c.2.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.T.E.i.o.t.5.2.y.r.z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.5.4.-.0.0.0.1.-.0.0.1.4.-.8.a.9.9.-.2.a.c.6.5.f.0.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.8.0.0.7.2.f.0.1.5.e.8.9.b.6.b.4.5.f.8.7.8.a.2.5.c.5.7.b.f.f.9.0.0.0.0.f.f.f.f.!.0.0.0.0.c.6.e.7.4.c.6.8.a.1.1.a.9.d.3.1.8.1.3.7.a.b.a.8.9.5.f.2.b.c.d.e.8.9.d.4.2.f.2.b.!.T.E.i.o.t.5.2.y.r.z...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.6././.2.1.:.1.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER319B.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Sep 10 10:53:37 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	143164
Entropy (8bit):	1.4890973548404032
Encrypted:	false
SSDEEP:	768:VS0dRtXD6tvQWrlzLiSwcl+ajiFcUAM00Ycs05:VtGWSwcl+ajiFcUAM00Ycs05
MD5:	758F8C737E871E435EAC81934EDD67D5
SHA1:	6D0F9AC2B28DC02E5C54045BAB6C20CB7E0A684A
SHA-256:	6EFB72D06EDD829B89F9A71F7658A588D4CEB9C3CDE52D21A5FD13D86D33FC70
SHA-512:	7B4A5124D4FF8F60392E32A4D054E7C914456D65EBE0FB22407E7EE28DE3B4E118F54228EB98271F4255B664774DA6BCCA9DB5DDBC86E2AF3181A73C443F40F8
Malicious:	false
Yara Hits:	Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER319B.tmp.dmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: C:\ProgramData\Microsoft\Windows\WER\Temp\WER319B.tmp.dmp, Author: unknown
Reputation:	low
Preview:	MDMP..a..... .......1%.f........................................,S..........T.......8...........T...........x...............P...........<...............................................................................eJ..............Lw......................T.......T...}..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3248.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8904
Entropy (8bit):	3.7022527896205872
Encrypted:	false
SSDEEP:	192:R6l7wVeJ5Pfm6YNlPU9WgmfO5pDa89b9Qkf/J/m:R6lXJhfm6YvPU9WgmfOv97fE
MD5:	6BB548B09CDC80C99113CD04121FAA58
SHA1:	4E292F35C8DFB3C85B1F2F042CEDD4FE10E65DB9
SHA-256:	C8FA248ABE06263ED2EC43E1BA9DDD6C218A9143C20CEB31F09C814E54FC18F2
SHA-512:	ED972BB85D10DBC9C104B1F19C39BD9D35C12B50732B8327A4262A402E3BB8B05EAE96CD761897EA0F45636D3FBEA57FD30F773C0F36BE79FA36034DBE81EB50
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3268.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4800
Entropy (8bit):	4.479614085306091
Encrypted:	false
SSDEEP:	48:cvIwWl8zshaJg771I9vrD8WpW8VYlYm8M4JK6OO1FfB6Fmyq8vG6OOnETx1d:uIjfhoI7Ux7V1JKB64FmWGBLTx1d
MD5:	705F0242C2E10DA316E7F0CF08ACBB1E
SHA1:	6D2CA6326BB4FC626C5FDC7E6536B68E9A49E4E4
SHA-256:	037E27635AB1111604AB4FB10120378FB226F8A5956B54AD02EF9BCF930A9BE9
SHA-512:	D9781985A74A21FF6CA36B302DDF63ACBE9DE710136D06D3CFB87C3E91A7F8849A3110B303FAAACD90B1F5F9A70411568CB01E8FFFAB2C1205EA7BF2CB5C7A6F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="494036" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416758848885135
Encrypted:	false
SSDEEP:	6144:Tcifpi6ceLPL9skLmb0mVSWSPtaJG8nAgex285i2MMhA20X4WABlGuN45+:Ii58VSWIZBk2MM6AFBWo
MD5:	EBD339429AB5788DC4184CB9A47FEE41
SHA1:	2563E222E87E1D971B1222AA44D333B5E81E7A38
SHA-256:	C60881FEE778E08EA70701FDA5A7AF1235DA64A31FB5F0EDC1150F3E3F961ED9
SHA-512:	962638F5A144BEF13D5045A4212C1772E02D29F6BE22109EC647EECB671A1739AEA1F9F886EE9C45769B91CAA2A82227C46D247ABA642113C1B8C5F302D80215
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm:"W.o.................................................................................................................................................................................................................................................................................................................................................@.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.5071715281779605
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TEiot52yrz.exe
File size:	53'760 bytes
MD5:	fa332de9a0e7da5e975173ee47246172
SHA1:	c6e74c68a11a9d318137aba895f2bcde89d42f2b
SHA256:	915cc233f5c3b36f2aa5a9a0aa2fcd28b8ee406e42c08b71177dab901c219d41
SHA512:	d929f944ebf93719ff6762bcfc56927a29418d71f72636be72b443f6c7d1e04dc6de6e56f8077e2c435f0d7afedf511e99c5768083c243f5f763587ec4158546
SSDEEP:	1536:zli07qgtT9e0uLwwpX996H810S4oqiedINb:zli07qgtg0uLwwp6HGgGb
TLSH:	F633394BEB5256F4F0BBE234C1A2B23BF9F139A45631AB0F96D555030B22770A43E749
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:n6\[.e\[.e\[.eU#.eP[.e...dX[.e...dV[.e...dG[.e...dZ[.e.#.dY[.e\[.e.[.eO..d_[.eO..d][.eRich\[.e........................PE..d..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1400032f8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66758E29 [Fri Jun 21 14:28:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	bd1e68ad73a2d648185022e899d7f29c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F14B9364E68h
dec eax
add esp, 28h
jmp 00007F14B9364767h
int3
int3
jmp 00007F14B936509Eh
int3
int3
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [00005090h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00005075h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F14B93648C7h
dec eax
lea edx, dword ptr [000099EFh]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F14B9364FBAh
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F14B93627FBh
dec eax
lea edx, dword ptr [00009A9Fh]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F14B9364F9Ah
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push ebp
push edi
inc ecx
push esi
dec eax
mov ebp, esp
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc esp
mov edx, edx
inc ecx
xor edx, 49656E69h
inc ecx
xor eax, 6C65746Eh
inc esp
mov ecx, ebx
inc esp
mov esi, eax
xor ecx, ecx
mov eax, 00000001h
cpuid
inc ebp
or edx, eax
mov dword ptr [ebp-10h], eax
inc ecx
xor ecx, 756E6547h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xce24	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xf000	0x630	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0x6c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc2f0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xc1b0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6432	0x6600	8759b1b67f2b54eac6557e9c4522457e	False	0.36278339460784315	Macintosh HFS Extended version -16056 data (mounted) last mounted by: 'H\20', created: Fri Aug 26 02:24:04 2078, last modified: Sun Mar 11 23:42:58 2057, last backup: Mon Dec 18 02:10:29 2028, block size: -1064976267, number of blocks: -616002748, free blocks: 609241227	5.60729868940022	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x5b70	0x5c00	7092854450d6513858403ce1ddf23e97	False	0.6414741847826086	data	7.175727936294308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe000	0x7a0	0x200	a762b3a5c773f37ff67e8e610aabbdce	False	0.251953125	DOS executable (block device driver)	2.236712118068703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xf000	0x630	0x800	200a12bd55e0318e3d7585101f49e6d3	False	0.3828125	data	3.4957689526148887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x6c	0x200	7068c81aba75ebf8f944a190333902ff	False	0.220703125	data	1.3343316886712333	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, GetModuleHandleW, IsDebuggerPresent, LoadLibraryA, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, InitializeSListHead, IsProcessorFeaturePresent, VirtualProtect
MSVCP140.dll	?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ, ?flags@ios_base@std@@QEBAHXZ, ?width@ios_base@std@@QEBA_JXZ, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ, ?uncaught_exception@std@@YA_NXZ, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?width@ios_base@std@@QEAA_J_J@Z, ?_Xlength_error@std@@YAXPEBD@Z, ?good@ios_base@std@@QEBA_NXZ
CRYPT32.dll	CertEnumSystemStore
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	memcpy, __std_exception_destroy, __std_exception_copy, memchr, memset, __C_specific_handler, _CxxThrowException, __current_exception, __current_exception_context
api-ms-win-crt-string-l1-1-0.dll	isalnum, strlen
api-ms-win-crt-runtime-l1-1-0.dll	_c_exit, _register_thread_local_exe_atexit_callback, __p___argv, _get_initial_narrow_environment, terminate, _register_onexit_function, _exit, exit, _crt_atexit, _initialize_narrow_environment, _initterm, _configure_narrow_argv, _set_app_type, _initterm_e, _invalid_parameter_noinfo_noreturn, _cexit, __p___argc, _seh_filter_exe, _initialize_onexit_table
api-ms-win-crt-heap-l1-1-0.dll	malloc, free, _set_new_mode, _callnewh
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	__p__commode, _set_fmode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-10T10:59:46.099185+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49699	116.198.231.169	63222	TCP
2024-09-10T10:59:50.318619+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49702	116.198.231.169	63222	TCP
2024-09-10T10:59:54.697952+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49705	116.198.231.169	63222	TCP
2024-09-10T10:59:59.017704+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49708	116.198.231.169	63222	TCP
2024-09-10T11:00:03.146814+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49713	116.198.231.169	63222	TCP
2024-09-10T11:00:07.587572+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49718	116.198.231.169	63222	TCP
2024-09-10T11:00:11.860949+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49721	116.198.231.169	63222	TCP
2024-09-10T11:00:16.128098+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49724	116.198.231.169	63222	TCP
2024-09-10T11:00:20.591162+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49727	116.198.231.169	63222	TCP
2024-09-10T11:00:25.056689+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49730	116.198.231.169	63222	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 10, 2024 10:59:43.972151995 CEST	49699	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:43.977313995 CEST	63222	49699	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:43.977458954 CEST	49699	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:43.991163015 CEST	49699	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:43.996651888 CEST	63222	49699	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:46.099113941 CEST	63222	49699	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:46.099184990 CEST	49699	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:46.099423885 CEST	49699	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:46.099953890 CEST	49700	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:46.104733944 CEST	63222	49699	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:46.105032921 CEST	63222	49700	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:46.105102062 CEST	49700	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:46.105573893 CEST	49700	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:46.110395908 CEST	63222	49700	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:48.151405096 CEST	63222	49700	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:48.151539087 CEST	49700	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:48.151684999 CEST	49700	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:48.152153015 CEST	49701	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:48.156481981 CEST	63222	49700	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:48.157078981 CEST	63222	49701	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:48.157314062 CEST	49701	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:48.157366991 CEST	49701	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:48.166421890 CEST	63222	49701	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:48.166537046 CEST	49701	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:48.172611952 CEST	49702	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:48.179253101 CEST	63222	49702	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:48.179580927 CEST	49702	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:48.179897070 CEST	49702	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:48.185365915 CEST	63222	49702	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:50.318541050 CEST	63222	49702	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:50.318619013 CEST	49702	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:50.318698883 CEST	49702	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:50.319192886 CEST	49703	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:50.323503017 CEST	63222	49702	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:50.323982954 CEST	63222	49703	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:50.324048042 CEST	49703	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:50.324383974 CEST	49703	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:50.329168081 CEST	63222	49703	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:52.520307064 CEST	63222	49703	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:52.520411968 CEST	49703	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:52.520508051 CEST	49703	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:52.521123886 CEST	49704	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:52.527534962 CEST	63222	49703	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:52.527661085 CEST	63222	49704	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:52.527739048 CEST	49704	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:52.527868032 CEST	49704	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:52.530951977 CEST	49705	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:52.535240889 CEST	63222	49704	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:52.535312891 CEST	49704	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:52.538208961 CEST	63222	49705	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:52.538311958 CEST	49705	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:52.538573027 CEST	49705	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:52.545279026 CEST	63222	49705	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:54.697649002 CEST	63222	49705	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:54.697952032 CEST	49705	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:54.697952032 CEST	49705	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:54.699110031 CEST	49706	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:54.702986956 CEST	63222	49705	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:54.704154968 CEST	63222	49706	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:54.704430103 CEST	49706	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:54.704484940 CEST	49706	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:54.709484100 CEST	63222	49706	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:56.756551027 CEST	63222	49706	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:56.756675005 CEST	49706	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:56.756788969 CEST	49706	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:56.757324934 CEST	49707	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:56.761663914 CEST	63222	49706	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:56.762231112 CEST	63222	49707	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:56.762334108 CEST	49707	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:56.762609005 CEST	49707	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:56.767800093 CEST	63222	49707	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:56.767811060 CEST	49708	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:56.767884970 CEST	49707	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:56.772756100 CEST	63222	49708	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:56.772840023 CEST	49708	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:56.773192883 CEST	49708	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:56.778187037 CEST	63222	49708	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:59.017549992 CEST	63222	49708	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:59.017704010 CEST	49708	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:59.018088102 CEST	49708	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:59.018752098 CEST	49709	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:59.024022102 CEST	63222	49708	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:59.024771929 CEST	63222	49709	116.198.231.169	192.168.2.7
Sep 10, 2024 10:59:59.024857044 CEST	49709	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:59.025238037 CEST	49709	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 10:59:59.030251980 CEST	63222	49709	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:01.049603939 CEST	63222	49709	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:01.049693108 CEST	49709	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:01.049894094 CEST	49709	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:01.050647020 CEST	49712	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:01.054769039 CEST	63222	49709	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:01.055771112 CEST	63222	49712	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:01.055845022 CEST	49712	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:01.056022882 CEST	49712	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:01.061100006 CEST	63222	49712	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:01.061155081 CEST	49712	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:01.061166048 CEST	49713	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:01.066019058 CEST	63222	49713	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:01.066124916 CEST	49713	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:01.066514969 CEST	49713	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:01.071779966 CEST	63222	49713	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:03.143757105 CEST	63222	49713	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:03.146814108 CEST	49713	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:03.148253918 CEST	49713	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:03.148775101 CEST	49716	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:03.153038025 CEST	63222	49713	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:03.153706074 CEST	63222	49716	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:03.153776884 CEST	49716	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:03.154088020 CEST	49716	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:03.158961058 CEST	63222	49716	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:05.434926033 CEST	63222	49716	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:05.434993982 CEST	49716	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:05.435138941 CEST	49716	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:05.435676098 CEST	49717	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:05.440125942 CEST	63222	49716	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:05.440861940 CEST	63222	49717	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:05.440939903 CEST	49717	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:05.441046953 CEST	49717	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:05.442179918 CEST	49718	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:05.446335077 CEST	63222	49717	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:05.446394920 CEST	49717	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:05.447007895 CEST	63222	49718	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:05.447069883 CEST	49718	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:05.447288990 CEST	49718	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:05.452447891 CEST	63222	49718	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:07.587426901 CEST	63222	49718	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:07.587572098 CEST	49718	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:07.587656021 CEST	49718	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:07.590481043 CEST	49719	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:07.592910051 CEST	63222	49718	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:07.596303940 CEST	63222	49719	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:07.596380949 CEST	49719	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:07.596662045 CEST	49719	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:07.601563931 CEST	63222	49719	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:09.816725016 CEST	63222	49719	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:09.816843987 CEST	49719	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:09.816936970 CEST	49719	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:09.820101976 CEST	49720	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:09.821743965 CEST	63222	49719	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:09.824927092 CEST	63222	49720	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:09.825016022 CEST	49720	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:09.825126886 CEST	49720	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:09.827548027 CEST	49721	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:09.830112934 CEST	63222	49720	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:09.830193996 CEST	49720	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:09.832587004 CEST	63222	49721	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:09.832662106 CEST	49721	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:09.832873106 CEST	49721	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:09.838016033 CEST	63222	49721	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:11.860795021 CEST	63222	49721	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:11.860949039 CEST	49721	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:11.861026049 CEST	49721	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:11.865348101 CEST	49722	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:11.865828991 CEST	63222	49721	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:11.871022940 CEST	63222	49722	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:11.871112108 CEST	49722	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:11.871618986 CEST	49722	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:11.877341032 CEST	63222	49722	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:14.081623077 CEST	63222	49722	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:14.081718922 CEST	49722	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:14.081842899 CEST	49722	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:14.086638927 CEST	63222	49722	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:14.091692924 CEST	49723	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:14.096596003 CEST	63222	49723	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:14.096662045 CEST	49723	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:14.096729040 CEST	49723	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:14.098356009 CEST	49724	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:14.101869106 CEST	63222	49723	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:14.101919889 CEST	49723	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:14.103277922 CEST	63222	49724	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:14.103333950 CEST	49724	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:14.103593111 CEST	49724	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:14.108494043 CEST	63222	49724	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:16.127887011 CEST	63222	49724	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:16.128098011 CEST	49724	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:16.128550053 CEST	49724	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:16.130781889 CEST	49725	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:16.133354902 CEST	63222	49724	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:16.135687113 CEST	63222	49725	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:16.135792017 CEST	49725	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:16.136075974 CEST	49725	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:16.140858889 CEST	63222	49725	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:18.163306952 CEST	63222	49725	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:18.163461924 CEST	49725	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:18.163582087 CEST	49725	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:18.167049885 CEST	49726	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:18.168477058 CEST	63222	49725	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:18.171889067 CEST	63222	49726	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:18.172049046 CEST	49726	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:18.172187090 CEST	49726	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:18.173966885 CEST	49727	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:18.177504063 CEST	63222	49726	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:18.177592993 CEST	49726	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:18.178792953 CEST	63222	49727	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:18.178858042 CEST	49727	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:18.179099083 CEST	49727	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:18.183881044 CEST	63222	49727	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:20.591058016 CEST	63222	49727	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:20.591161966 CEST	49727	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:20.591257095 CEST	49727	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:20.591325045 CEST	63222	49727	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:20.591372967 CEST	49727	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:20.593662024 CEST	49728	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:20.596359968 CEST	63222	49727	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:20.598519087 CEST	63222	49728	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:20.598618031 CEST	49728	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:20.599016905 CEST	49728	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:20.603828907 CEST	63222	49728	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:22.684892893 CEST	63222	49728	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:22.685106993 CEST	49728	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:22.685138941 CEST	49728	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:22.688007116 CEST	49729	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:22.691412926 CEST	63222	49728	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:22.692833900 CEST	63222	49729	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:22.692923069 CEST	49729	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:22.693108082 CEST	49729	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:22.695633888 CEST	49730	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:22.698731899 CEST	63222	49729	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:22.698800087 CEST	49729	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:22.700431108 CEST	63222	49730	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:22.700503111 CEST	49730	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:22.700844049 CEST	49730	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:22.705663919 CEST	63222	49730	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:25.056629896 CEST	63222	49730	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:25.056689024 CEST	49730	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:25.056796074 CEST	49730	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:25.056905985 CEST	63222	49730	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:25.056943893 CEST	49730	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:25.061747074 CEST	63222	49730	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:25.070270061 CEST	49731	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:25.075108051 CEST	63222	49731	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:25.075193882 CEST	49731	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:25.075467110 CEST	49731	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:25.080230951 CEST	63222	49731	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:27.225442886 CEST	63222	49731	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:27.225560904 CEST	49731	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:27.225641966 CEST	49731	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:27.230053902 CEST	49732	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:27.230480909 CEST	63222	49731	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:27.234925985 CEST	63222	49732	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:27.235027075 CEST	49732	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:27.236588001 CEST	49732	63222	192.168.2.7	116.198.231.169
Sep 10, 2024 11:00:27.241586924 CEST	63222	49732	116.198.231.169	192.168.2.7
Sep 10, 2024 11:00:27.241638899 CEST	49732	63222	192.168.2.7	116.198.231.169

Target ID:	0
Start time:	04:59:41
Start date:	10/09/2024
Path:	C:\Users\user\Desktop\TEiot52yrz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\TEiot52yrz.exe"
Imagebase:	0x7ff629540000
File size:	53'760 bytes
MD5 hash:	FA332DE9A0E7DA5E975173EE47246172
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:53:37
Start date:	10/09/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6740 -s 1100
Imagebase:	0x7ff671c80000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	0.5%
Signature Coverage:	8.3%
Total number of Nodes:	375
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF629546AFC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 99
librarymemoryencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF629546CC0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF629546D51
Part of subcall function 00007FF629546CC0: memcpy.VCRUNTIME140 ref: 00007FF629546D66
Part of subcall function 00007FF629546CC0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF629546DAA
Part of subcall function 00007FF629546CC0: memcpy.VCRUNTIME140 ref: 00007FF629546DC2

LoadLibraryA.KERNEL32 ref: 00007FF629546C50
VirtualProtect.KERNELBASE ref: 00007FF629546C73
CertEnumSystemStore.CRYPT32 ref: 00007FF629546C8B

Strings

W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu, xrefs: 00007FF629546B4A
W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu, xrefs: 00007FF629546B66
fTk0IXs+RsZrY9epOUeq1oQ0l4RoVPjlVJoEuMX3zPeE+je8GdHrJUcxFZpepdr4SDRVKa6s7ouAvVNOqjbmDXauHJGPlOuvClVpjZvRyLdC2d6h5WF7twqC1kX9nIKWgL9KaawEYPrhgpcPJeSSnLatPbvLnYxgng2QCJQ8DmxkwRBosnzlWeW39pnWOJcwZvMht1Ue7ys35aku9WPa2jr1RTE8qRhrprEAHTM+xpPpcOmcTSt4aUDyEbOtWv6EV/1G, xrefs: 00007FF629546B2E
kernel32.dll, xrefs: 00007FF629546C49

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorkmemcpy$CertEnumLibraryLoadProtectStoreSystemVirtual
String ID: W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu$W9UKQW5ltwlY8AGQc4nGwxhRPfHnsqCu$fTk0IXs+RsZrY9epOUeq1oQ0l4RoVPjlVJoEuMX3zPeE+je8GdHrJUcxFZpepdr4SDRVKa6s7ouAvVNOqjbmDXauHJGPlOuvClVpjZvRyLdC2d6h5WF7twqC1kX9nIKWgL9KaawEYPrhgpcPJeSSnLatPbvLnYxgng2QCJQ8DmxkwRBosnzlWeW39pnWOJcwZvMht1Ue7ys35aku9WPa2jr1RTE8qRhrprEAHTM+xpPpcOmcTSt4aUDyEbOtWv6EV/1G$kernel32.dll
API String ID: 1274391132-1474288648
Opcode ID: 0021a513d3075bfe4559da1246eef3f31aed97dd76e4d3ed1e31a3c18aea7553
Instruction ID: b486d0924aa4444396b04851f23d3558a3ef8f2dda9494821d4b2efedd4f040d
Opcode Fuzzy Hash: 0021a513d3075bfe4559da1246eef3f31aed97dd76e4d3ed1e31a3c18aea7553
Instruction Fuzzy Hash: BC41442271DAC595DEA0DF10E8503EA67A1FBD8384F801132E68DD3BA9EE2CD519DF01

Function 00007FF62954317C Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6295431A5
__scrt_release_startup_lock.LIBCMT ref: 00007FF629543213
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF629543261
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF629543266
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF62954326E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF629543276
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF629543298
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6295432F2

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: b8b73077751ae62d481563376bd79326efdf3318ec70507a033230f709591385
Instruction ID: a492abc1a09cdffeca92ecd9d5474bc0032bb6046ac42a2f9da273c51fd7c6a2
Opcode Fuzzy Hash: b8b73077751ae62d481563376bd79326efdf3318ec70507a033230f709591385
Instruction Fuzzy Hash: E2314B21B0C15342FED4AF65BE513B92291AFC5784F446434E64EA72F7DE3DE424AE02

Function 000000E1057AE24B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpOpenRequestA.WININET(00000000,00000000,84C03200,00000000), ref: 000000E1057AE266

Strings

U.;, xrefs: 000000E1057AE261

Memory Dump Source

Source File: 00000000.00000002.2172455610.000000E1057AE000.00000040.00000010.00020000.00000000.sdmp, Offset: 000000E1057AE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1057ae000_TEiot52yrz.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: U.;
API String ID: 1984915467-4213443877
Opcode ID: ab09341529980e95ac1e803047b3985bc20a26ea9b837d55d995e7e224907264
Instruction ID: 4026e91d0868342a8665c3115d9968d5ffcada5904e453a22f2d639fbac57f4f
Opcode Fuzzy Hash: ab09341529980e95ac1e803047b3985bc20a26ea9b837d55d995e7e224907264
Instruction Fuzzy Hash: 3411BE7034880D0BF62941ADBC5673621CBD3C8715F24813FB50ED33C6DCA4CC82555A

Non-executed Functions

Function 00007FF62954365C Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF629543678
memset.VCRUNTIME140 ref: 00007FF62954369C
RtlCaptureContext.KERNEL32 ref: 00007FF6295436A5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6295436BF
RtlVirtualUnwind.KERNEL32 ref: 00007FF629543700
memset.VCRUNTIME140 ref: 00007FF629543733
IsDebuggerPresent.KERNEL32 ref: 00007FF629543754
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF629543771
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62954377C

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 7335fbb8426a945ac828c7077c8e300b3c8bd9ec95d4022230abd3d7a7f75a14
Instruction ID: 8658e0dff06bf7b94e78f67a2587082843cc3696e60d162166858b5a035b3668
Opcode Fuzzy Hash: 7335fbb8426a945ac828c7077c8e300b3c8bd9ec95d4022230abd3d7a7f75a14
Instruction Fuzzy Hash: B6313B72719A8186EBA09F60E8403ED7360FB84744F04503ADB4E97B94EF3CD658DB11

Function 00007FF629543DE8 Relevance: 6.6, APIs: 2, Strings: 2, Instructions: 581
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FF629543E4A
, xrefs: 00007FF629543E27

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: d8bd270e9d87edd875d7f9d873967e908e7bfa0f1dd1a07bdc383474c52699a2
Instruction ID: 4841806a01c5ef58ade828d272e32f7421cdc8d132d706bf74b9d18214a63791
Opcode Fuzzy Hash: d8bd270e9d87edd875d7f9d873967e908e7bfa0f1dd1a07bdc383474c52699a2
Instruction Fuzzy Hash: 7152E872609A81CADBB4CF19E88076AB7A1F7C8B45F045236E68E97B58CB3CD551DF00

Function 00007FF629543874 Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6295438A0
GetCurrentThreadId.KERNEL32 ref: 00007FF6295438AE
GetCurrentProcessId.KERNEL32 ref: 00007FF6295438BA
QueryPerformanceCounter.KERNEL32 ref: 00007FF6295438CA

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9b69f90bbb091b32707effc177f545cd80205cc59f5ac2c3711d41dd0f4641bd
Instruction ID: 4141f0472805c2735af0acf874d02a9738f967ca248574ffba79e66354daaa40
Opcode Fuzzy Hash: 9b69f90bbb091b32707effc177f545cd80205cc59f5ac2c3711d41dd0f4641bd
Instruction Fuzzy Hash: 53117022B14F018AEF40CF60EC442B933A4F758758F041E31DA6D927A4DF7CE1689741

Function 00007FF6295454A4 Relevance: .6, Instructions: 556COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114221cd8fb83a4d1b3f4e9c07f063070523e9746f19f36e16c9c60b1fbf2ef1
Instruction ID: b455985ec65b032a2dc14119f3f0c92eabb689d7ce8db0cdc6d785a60c0b6cb5
Opcode Fuzzy Hash: 114221cd8fb83a4d1b3f4e9c07f063070523e9746f19f36e16c9c60b1fbf2ef1
Instruction Fuzzy Hash: D0421A72318A818ADB54CF1DE89163ABBA1F7C8B84F445126E78EC3B69DA3CD551DF00

Function 00007FF629545D5C Relevance: .6, Instructions: 556COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a46b35d7a26a7fb26f39faf249998ab39fdfcee5fcf209b6738682e87834f0
Instruction ID: 5886f532a9bb8be2fe59ef379529b8a4f132de7dc7c069faa2ae967c610546fb
Opcode Fuzzy Hash: 54a46b35d7a26a7fb26f39faf249998ab39fdfcee5fcf209b6738682e87834f0
Instruction Fuzzy Hash: EF422B72319A818ADB55CF1DE8A163AB7A1F7C8B90F444126E78EC3B69CA3CD551DF00

Function 00007FF629545785 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f29163b5e8fdaf0dc49c2304f5fe647261e8bcf9fb33c4e691343a0f95705ad
Instruction ID: fb27e2df86bd2df515c15f63a9d66e2d1a15e4a4fa92d48b5e65334833609dfc
Opcode Fuzzy Hash: 4f29163b5e8fdaf0dc49c2304f5fe647261e8bcf9fb33c4e691343a0f95705ad
Instruction Fuzzy Hash: 6B6161B26189818BDB64CF18E89067AB3A2FBCC740F455635E34AC7B59DA3CE610DF00

Function 00007FF62954603A Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92bf19dc8cd86aff032756dfb13700223f95881ed97291965757eed8e9fc06d6
Instruction ID: 4ab9bef5ec9e8daf4e38ba8ce9160778064339987464da54566b6d1875f66f41
Opcode Fuzzy Hash: 92bf19dc8cd86aff032756dfb13700223f95881ed97291965757eed8e9fc06d6
Instruction Fuzzy Hash: 456163B26189818BDB64CF08E89067AB3A2FBCCB45F445635E34A87B59CA3CE550DF00

Function 00007FF629543804 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b4fbbec666916b0587e8a13de0dadc5ecbb71f9984410eb9ff46545bbfccba
Instruction ID: 52528133312f5e6f59409702937aac08cf818a86a77e50214ff6a11085785b79
Opcode Fuzzy Hash: 43b4fbbec666916b0587e8a13de0dadc5ecbb71f9984410eb9ff46545bbfccba
Instruction Fuzzy Hash: C2A00121A19882D0EE948F00EE50021A370AB90300B556871C50DA20609E3CA568AA23

Function 00007FF62954253C Relevance: 21.2, APIs: 14, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF629541ABC: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00007FF6295415D6,?,?,?,?,?,?,00007FF629541017), ref: 00007FF629541ACA

?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF629542593
?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF6295425BE
?width@ios_base@std@@QEBA_JXZ.MSVCP140 ref: 00007FF6295425EB
?flags@ios_base@std@@QEBAHXZ.MSVCP140 ref: 00007FF629542664
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP140 ref: 00007FF6295426B3
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF6295426DA
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6295426E9
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF629542743
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF629542759
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ.MSVCP140 ref: 00007FF6295427C1
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF6295427E8
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF6295427F7
?width@ios_base@std@@QEAA_J_J@Z.MSVCP140 ref: 00007FF62954284C
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF62954287C

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?width@ios_base@std@@$?rdbuf@?$basic_ios@D@std@@@2@V?$basic_streambuf@$?fill@?$basic_ios@?sputc@?$basic_streambuf@$?flags@ios_base@std@@?setstate@?$basic_ios@?sputn@?$basic_streambuf@strlen
String ID:
API String ID: 207065933-0
Opcode ID: f4bc5cb1901ef092bd8a86ad73b7320c61d8d2db2b875ebc753e22042a0a0f00
Instruction ID: ea76850606f8cf646f5abc4a20268e71c283088d46c8a4013123401e624e6843
Opcode Fuzzy Hash: f4bc5cb1901ef092bd8a86ad73b7320c61d8d2db2b875ebc753e22042a0a0f00
Instruction Fuzzy Hash: 2BA1E936B09B8586DEA4DF56E89436AB7A0FBC8B85F009035DA8ED7764DE3CD0149F01

Function 00007FF629546CC0 Relevance: 9.2, APIs: 6, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF629546D51
memcpy.VCRUNTIME140 ref: 00007FF629546D66
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF629546DAA
memcpy.VCRUNTIME140 ref: 00007FF629546DC2
memset.VCRUNTIME140 ref: 00007FF629546EC5
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140 ref: 00007FF629546EE8

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredV01@Workmemcpy$??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@@memset
String ID:
API String ID: 2816322446-0
Opcode ID: b9c5c220a8161afe00995a3b5838346bc2764bb80acdb38bfd23fd1c6c53baac
Instruction ID: 2810d6782709569ca38b50ec0a6295ab62e3f339d54b59665c7b86b8a03aab4d
Opcode Fuzzy Hash: b9c5c220a8161afe00995a3b5838346bc2764bb80acdb38bfd23fd1c6c53baac
Instruction Fuzzy Hash: 6681E73261DA8585DAA0DF15F8903AEB7A0FBC5780F502026EA8E93B69DF3CD054DF01

Function 00007FF629542968 Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF629542A98: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140(?,?,?,?,?,?,00007FF629542985), ref: 00007FF629542ADA

?good@ios_base@std@@QEBA_NXZ.MSVCP140 ref: 00007FF6295429A0
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 00007FF6295429D2

Memory Dump Source

Source File: 00000000.00000002.2172836020.00007FF629541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF629540000, based on PE: true

Associated: 00000000.00000002.2172821940.00007FF629540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172851575.00007FF629548000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172866695.00007FF62954E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172881719.00007FF62954F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff629540000_TEiot52yrz.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@2@D@std@@@std@@$?good@ios_base@std@@?rdbuf@?$basic_ios@?tie@?$basic_ios@V?$basic_ostream@V?$basic_streambuf@
String ID:
API String ID: 3792166412-0
Opcode ID: 61c6c2cae3a07f63e2bf5b4d9e59194abfd40384aa0aa098eae079579a8cfedb
Instruction ID: 8a80ca00c31502ae5c772a893b6b3b5998c4cb646b33f35058f22d30c488caf5
Opcode Fuzzy Hash: 61c6c2cae3a07f63e2bf5b4d9e59194abfd40384aa0aa098eae079579a8cfedb
Instruction Fuzzy Hash: 5721B92670DB8581DE54DF1AE894229ABB0FBC9B84F509026EF8D93728DF3DD494DB01

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TEiot52yrz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Threatname: Metasploit

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_TEiot52yrz.exe_2714b4b2d07e7c82202e7568b15aa71dbc91f2_8fd4efbb_65b56a23-ade3-47d4-9527-560feaa0e927\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER319B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3248.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3268.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
TEiot52yrz.exe

Function 00007FF629546AFC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 99
librarymemoryencryptionCOMMON

Function 00007FF62954317C Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Function 000000E1057AE24B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99
networkCOMMON

Function 00007FF62954365C Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Function 00007FF629543DE8 Relevance: 6.6, APIs: 2, Strings: 2, Instructions: 581
COMMON

Function 00007FF629543874 Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMON

Function 00007FF62954253C Relevance: 21.2, APIs: 14, Instructions: 201
COMMON

Function 00007FF629546CC0 Relevance: 9.2, APIs: 6, Instructions: 166
COMMON

Function 00007FF629542968 Relevance: 6.1, APIs: 4, Instructions: 53
COMMON