Edit tour

Windows Analysis Report
Flash USDT Sender.exe

Overview

General Information

Sample name:	Flash USDT Sender.exe
Analysis ID:	1513687
MD5:	54ddbd4b606a89ea2df3106d1a1c7ddf
SHA1:	3e0bd1e9538bf923255f28c446042333cf4a8c8f
SHA256:	08dfd2902c7392d2a92747ad04fe87ba97ac9da34f6838e33cc464e13cc3ca5b
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Detected potential crypto function

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

Flash USDT Sender.exe (PID: 7288 cmdline: "C:\Users\user\Desktop\Flash USDT Sender.exe" MD5: 54DDBD4B606A89EA2DF3106D1A1C7DDF)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://flashusdt.shop/

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Flash USDT Sender.exe

Virustotal: Detection: 21%

Perma Link

Machine Learning detection for sample

Source: Flash USDT Sender.exe

Joe Sandbox ML: detected

Source: Flash USDT Sender.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Flash USDT Sender.exe, 00000000.00000002.2969253673.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Flash USDT Sender.exe	String found in binary or memory: https://flashusdt.shop/

Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Code function: 0_2_02D3C1B8	0_2_02D3C1B8
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Code function: 0_2_07A15448	0_2_07A15448
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Code function: 0_2_07A183B0	0_2_07A183B0
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Code function: 0_2_07A11081	0_2_07A11081
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Code function: 0_2_07A13B30	0_2_07A13B30
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Code function: 0_2_07A14990	0_2_07A14990
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Code function: 0_2_07A165C0	0_2_07A165C0
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Code function: 0_2_07A160F8	0_2_07A160F8
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Code function: 0_2_07A14990	0_2_07A14990
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Code function: 0_2_07A183B0	0_2_07A183B0

Source: Flash USDT Sender.exe, 00000000.00000002.2968451486.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs Flash USDT Sender.exe

Source: classification engine

Classification label: mal60.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Flash USDT Sender.exe

Mutant created: NULL

Source: Flash USDT Sender.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Flash USDT Sender.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Flash USDT Sender.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Flash USDT Sender.exe

Virustotal: Detection: 21%

Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Section loaded: wintypes.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Flash USDT Sender.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Flash USDT Sender.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Flash USDT Sender.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Flash USDT Sender.exe

Static PE information: 0xED3E1D21 [Thu Feb 16 22:48:01 2096 UTC]

Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Memory allocated: 1490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Memory allocated: 2E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Flash USDT Sender.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Users\user\Desktop\Flash USDT Sender.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Flash USDT Sender.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Flash USDT Sender.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
Flash USDT Sender.exe	17%	ReversingLabs
Flash USDT Sender.exe	22%	Virustotal	Browse
Flash USDT Sender.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
https://flashusdt.shop/	100%	Avira URL Cloud	malware
https://flashusdt.shop/	1%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.goodfont.co.kr	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://flashusdt.shop/	Flash USDT Sender.exe	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.jiyu-kobo.co.jp/	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Flash USDT Sender.exe, 00000000.00000002.2969253673.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	Flash USDT Sender.exe, 00000000.00000002.2970720027.0000000007082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1513687
Start date and time:	2024-09-19 08:00:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Flash USDT Sender.exe
Detection:	MAL
Classification:	mal60.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 30 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.021729253342202
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Flash USDT Sender.exe
File size:	794'112 bytes
MD5:	54ddbd4b606a89ea2df3106d1a1c7ddf
SHA1:	3e0bd1e9538bf923255f28c446042333cf4a8c8f
SHA256:	08dfd2902c7392d2a92747ad04fe87ba97ac9da34f6838e33cc464e13cc3ca5b
SHA512:	be3501c8533397e9c784c6d5e2238b0cb987147dddcc250fb8bfa8dc1ae30c129bf07aa80e54ee076d3ee55ba2b5198b29849f6d68bc9559d964ce4260fec75f
SSDEEP:	12288:CYZzBxAHBmPLSoiy76qlHHyH7VVLg3ip8:nAhmeoiy7XlHEVVL
TLSH:	FAF4CF427E0CDE51E86F463C0B39C9481A732C56EAD4A89FFA867FCB193FD128913651
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!.>..........."...P..j............... ........@.. ....................................`................................

File Icon


Icon Hash:	176971d2f0733307

Static PE Info

General

Entrypoint:	0x4a88de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xED3E1D21 [Thu Feb 16 22:48:01 2096 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa888c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x1aea6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa68e4	0xa6a00	503fc1e711d8eb833e9406a26c9aa110	False	0.5417482300262566	data	6.337965381029678	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x1aea6	0x1b000	6fd193dea0b4e5c189e5114ec5dcfe04	False	0.14993851273148148	data	3.590748778442056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc6000	0xc	0x200	3fcb25b6985aa831cd5b1d98be2b9553	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xaa220	0x21db	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9901926848967347
RT_ICON	0xac3fc	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 120945 x 120945 px/m	0.050588548444339285
RT_ICON	0xbcc24	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 120945 x 120945 px/m	0.08862777515351913
RT_ICON	0xc0e4c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 120945 x 120945 px/m	0.1146265560165975
RT_ICON	0xc33f4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 120945 x 120945 px/m	0.15408067542213882
RT_ICON	0xc449c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 120945 x 120945 px/m	0.25620567375886527
RT_GROUP_ICON	0xc4904	0x5a	data	0.7666666666666667
RT_VERSION	0xc4960	0x35c	data	0.4046511627906977
RT_MANIFEST	0xc4cbc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Download Network PCAP: filtered – full

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 19, 2024 08:01:39.350281000 CEST	53	49707	1.1.1.1	192.168.2.4
Sep 19, 2024 08:01:40.833364010 CEST	53	51598	1.1.1.1	192.168.2.4

Statistics

CPU Usage

• Flash USDT Sender.exe

Click to jump to process

Memory Usage

• Flash USDT Sender.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

System Behavior

Analysis Process: Flash USDT Sender.exePID: 7288, Parent PID: 2580

Function Logs

General

Target ID:	0
Start time:	02:01:19
Start date:	19/09/2024
Path:	C:\Users\user\Desktop\Flash USDT Sender.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Flash USDT Sender.exe"
Imagebase:	0xa50000
File size:	794'112 bytes
MD5 hash:	54DDBD4B606A89EA2DF3106D1A1C7DDF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

File Created

File Read

File Attributes Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Value Queried

Key Value Enumerated

Key Enumerated

Show Windows behavior

Mutex Activities

Mutex Created

Show Windows behavior

Process Activities

Process Queried

Process Information Set

Show Windows behavior

Thread Activities

Thread Created

Thread Execution Resumed

Thread Information Set

Show Windows behavior

Memory Activities

Memory Allocated

Memory Protection Changed

Memory Usage Statistics

Show Windows behavior

System Activities

Language or Locale ID Queried

System Information Queried

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

Window Created

Window UI Enumerated

Show Windows behavior

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

Analysis Process: Flash USDT Sender.exePID: 7288, Parent PID: 2580COMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	116
Total number of Limit Nodes:	11

Executed Functions

Function 07A13B30 Relevance: 5.3, Strings: 4, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hhq, xrefs: 07A13CA6
, xrefs: 07A13BCC
(hq, xrefs: 07A13C7A
(&dq, xrefs: 07A13E01

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID: $(&dq$(hq$Hhq
API String ID: 0-214990412
Opcode ID: 83bc78d6e05e9bfdb60c1c4126c297e34831cd016970888643256abe37c2d7cb
Instruction ID: 0444e6059ea53e2fe08d218d7a65e8ed06d31ea0c7bdc15b8b66ac193c341357
Opcode Fuzzy Hash: 83bc78d6e05e9bfdb60c1c4126c297e34831cd016970888643256abe37c2d7cb
Instruction Fuzzy Hash: 0F915CB1E002169FEB18DF79C4546AFBAF6BFC8710F108429E415AB294DB359905CBA1

Function 07A15448 Relevance: 3.2, Strings: 2, Instructions: 693
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fff?, xrefs: 07A15AAF
fff?, xrefs: 07A15B20, 07A15B4A, 07A15B6B, 07A15B8C, 07A15E08, 07A15E0B, 07A15C6B, 07A15E17

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID: fff?$fff?
API String ID: 0-556400270
Opcode ID: 9bf86bb4fccbd72694bc0b7bf56d841f7d019548e5b99008fe0651d2b9f6f86d
Instruction ID: deb802e93c39df32bb45ed7b746f24ee283669e98a009cf3cddf9d721e979320
Opcode Fuzzy Hash: 9bf86bb4fccbd72694bc0b7bf56d841f7d019548e5b99008fe0651d2b9f6f86d
Instruction Fuzzy Hash: 01622A3281061ADFCF11DF50C884AD9B7B2FF9A300F1586D5E9186B165EB71AAD6CF80

Function 07A14990 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ef6d8a5181c7a3928fddcbbae1a9f84ab9e55c97fd33e5dc90f0ab4255b115
Instruction ID: 82a04d7108f9813ce298b7de7cf6ec0e4e88752e598c49499de5bccdd5124eee
Opcode Fuzzy Hash: 80ef6d8a5181c7a3928fddcbbae1a9f84ab9e55c97fd33e5dc90f0ab4255b115
Instruction Fuzzy Hash: 88526075A1065ACFDB21DF68C844AE9B7B1FF89300F1581D9E819AB261DB31EE81CF41

Function 07A183B0 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b7e15ec3a99dd8dc815872c41e0f4c0bbe380d27313fd4fe1a7d9667c5b015
Instruction ID: 89114d932735693946e2c6be347b8ff6e7e1dacce1d1ee8582fac45a9d568467
Opcode Fuzzy Hash: 44b7e15ec3a99dd8dc815872c41e0f4c0bbe380d27313fd4fe1a7d9667c5b015
Instruction Fuzzy Hash: B8324871A1061ACFDB21DF64C944BD9B7B2FF89310F1585E9E819AB220DB74AE85CF40

Function 07A11081 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09b96581b12db413fded53a5be8597049c49f58ac129e38a3fec7d59a2d4192
Instruction ID: 1454fac1900a58d2705fcbfefd5560bb4d96c97aa5c5d07ccf2c3b7bca209dee
Opcode Fuzzy Hash: a09b96581b12db413fded53a5be8597049c49f58ac129e38a3fec7d59a2d4192
Instruction Fuzzy Hash: 83D181B0A0031ACFEB14DFA5C848B9DBBF1BF84314F158568E529AB2A5DB70D985CB40

Function 02D3D4C8 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02D3D72E

Memory Dump Source

Source File: 00000000.00000002.2969137242.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_Flash USDT Sender.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 605504befeda81731def80c0b96f3fa1ff6283d4427d81f17a962dcbbe5d2360
Instruction ID: 863f8b141e86c81db291aac4836c88f6c4fe01fe0c2a1979c7eb6a5df4379407
Opcode Fuzzy Hash: 605504befeda81731def80c0b96f3fa1ff6283d4427d81f17a962dcbbe5d2360
Instruction Fuzzy Hash: 268113B0A00B458FD766DF29D44479ABBF2FB89304F008929D49AD7B50DB75E849CFA0

Function 02D3C53C Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02D3FBE2

Memory Dump Source

Source File: 00000000.00000002.2969137242.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_Flash USDT Sender.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6146c8c89cb1adc0130525d85966f66cb0e54a80df0180f029d2994f22fe8929
Instruction ID: ba2fcc91275a70c47cc4952681b40d1f7cf2d36ff8b453e2b259d7d98f502ab7
Opcode Fuzzy Hash: 6146c8c89cb1adc0130525d85966f66cb0e54a80df0180f029d2994f22fe8929
Instruction Fuzzy Hash: EE51BEB1D1030D9FDB15CF9AC994ADEBBB5FF88314F24812AE819AB210D775A845CF90

Function 02D3FE68 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 02D3FEFF

Memory Dump Source

Source File: 00000000.00000002.2969137242.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_Flash USDT Sender.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 2a43c9b74c62651186be1e8becc11ee3d9b4f3139f2147e3459fc8e39d043edb
Instruction ID: 628d1d8f7163f010f075708dde270be53c61748c254ff8650d35f7ea5df2c7d0
Opcode Fuzzy Hash: 2a43c9b74c62651186be1e8becc11ee3d9b4f3139f2147e3459fc8e39d043edb
Instruction Fuzzy Hash: 6D21FDB5D003099FDB11CF9AD884AAEFBF5FB48324F14842AE819A7310D775A944CFA0

Function 02D37780 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02D3780F

Memory Dump Source

Source File: 00000000.00000002.2969137242.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_Flash USDT Sender.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4a32120cd6867b681fa07ae0d767f02b895d9d93f0a2c105161475e860a62a2d
Instruction ID: 676dd8075ba2abfeb548a48a56631e57425ccfc539529eedbb5ae2ab70316d15
Opcode Fuzzy Hash: 4a32120cd6867b681fa07ae0d767f02b895d9d93f0a2c105161475e860a62a2d
Instruction Fuzzy Hash: AB2105B59003489FDB10CFAAD884AEEFFF4EB48310F14841AE954A3310D374A940CF60

Function 02D37788 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02D3780F

Memory Dump Source

Source File: 00000000.00000002.2969137242.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_Flash USDT Sender.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a689c7ac3f9587a51e133e950e24eb35b64c899b5cb9b68da0ef7be0a68eb782
Instruction ID: 8dca6efa1e58226831402a28505cec8b6bd634f5e27c459d8b21c0e3b43892d4
Opcode Fuzzy Hash: a689c7ac3f9587a51e133e950e24eb35b64c899b5cb9b68da0ef7be0a68eb782
Instruction Fuzzy Hash: 2521E3B59002089FDB10CFAAD984ADEFBF4EB48320F14841AE918A3350D374A944CFA0

Function 07A11588 Relevance: 1.6, APIs: 1, Instructions: 55
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 07A115F8

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: ad01e9b559adf8e14b8cfcf957273820ef443f7d7242c18d561029aad2ab3d00
Instruction ID: 3f33f4d992ee782555aef760743858d0f727d656f0ef9071c9fb2c4c062b773a
Opcode Fuzzy Hash: ad01e9b559adf8e14b8cfcf957273820ef443f7d7242c18d561029aad2ab3d00
Instruction Fuzzy Hash: 711123B58003599FDB10CF9AD944BDEBBF8EB48320F10842AE968A3251C378A544CFA5

Function 07A117B0 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 07A1181D

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a13a91fe93a83aa3c5793987db376134d8946b2b32101ef1b8ab2445b62a4be4
Instruction ID: 01fa7b6bf92ced44f906484a540962344c002fb22b60732b43e72c4666500d0c
Opcode Fuzzy Hash: a13a91fe93a83aa3c5793987db376134d8946b2b32101ef1b8ab2445b62a4be4
Instruction Fuzzy Hash: 6311F6B5C043499FDB10DF9AD845BDEFBF8EB48320F14842AE958A3641C379A544CFA5

Function 07A11590 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 07A115F8

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 531e3eeff3bf66c8ce6ee356f15c50b5e71bb01f7e6c87c032130ae06a7b005d
Instruction ID: a69433594dd59aeedcfd3e4c66788d7d76968e671fcadf4c21676006dd14beb7
Opcode Fuzzy Hash: 531e3eeff3bf66c8ce6ee356f15c50b5e71bb01f7e6c87c032130ae06a7b005d
Instruction Fuzzy Hash: 961104B580035D9FDB10CF9AD944BDEFBF8EB48320F10842AE969A3251C379A544CFA5

Function 07A117B8 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 07A1181D

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: f4e974e9d19c2794d04f9d93ebbe9d5f51bdd1831ad7fb5272e1bc97a7fedfc6
Instruction ID: ba91dc6c31dbd69b72db27a60e9f78a08b6cda680aa4e08006f93ff43ac0481a
Opcode Fuzzy Hash: f4e974e9d19c2794d04f9d93ebbe9d5f51bdd1831ad7fb5272e1bc97a7fedfc6
Instruction Fuzzy Hash: 1711C3B58003499FDB10DF9AD844BDEFBF8EB48320F14842AE968A3641C378A544CFA5

Function 02D3D6C8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02D3D72E

Memory Dump Source

Source File: 00000000.00000002.2969137242.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_Flash USDT Sender.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9c7c27b7da54e356b37571ade5d293444d989954acf225606658d49337ae4bea
Instruction ID: 7be4ef01850c41605f25879ac327fea8f7d5ede79cedbdc302952ae59a942cde
Opcode Fuzzy Hash: 9c7c27b7da54e356b37571ade5d293444d989954acf225606658d49337ae4bea
Instruction Fuzzy Hash: DC11E0B5C003498FDB11DF9AC848ADEFBF5EB88324F10846AD469A7310C379A545CFA1

Function 02D3F6EC Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?,?,?,?,?,?,02D3FD00,?,?,?,?), ref: 02D3FD75

Memory Dump Source

Source File: 00000000.00000002.2969137242.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_Flash USDT Sender.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: cc63f1f1e4b6107ac8aa9164354dc2fce8c6cf152cdbd8792736e89476e4b907
Instruction ID: 38834c7555f5a9d77d44b9cc617b4aae1469c4f8039ac4772a0770a73121e9a8
Opcode Fuzzy Hash: cc63f1f1e4b6107ac8aa9164354dc2fce8c6cf152cdbd8792736e89476e4b907
Instruction Fuzzy Hash: 9A1136B580034C8FDB10DF9AD588BDEBBF8EB88320F108419D958A7701C374A944CFA1

Function 07A11C80 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 07A11CE5

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 65bf6fa1fe987f563a365d9d2a65ebffb1a9251a7e477a00f218cb8bd363971e
Instruction ID: e19a96cbf0a09fcdad340ae7a37e1b761f8fbf175468c6e633c8c2b1beda8a81
Opcode Fuzzy Hash: 65bf6fa1fe987f563a365d9d2a65ebffb1a9251a7e477a00f218cb8bd363971e
Instruction Fuzzy Hash: 981110B5C003499FDB10DF9AD848ACEBBF4EB48324F10841AD868A3600C778A544CFA5

Function 07A1C668 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageA.USER32 ref: 07A1C6CD

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 8edc7bd36405b16ebbc6cc3666236d9de2b87a26e9749873c2304ad168133898
Instruction ID: 2971785e5a26befc6cc77e09233eca42bfb5b55ca4c725986e0d0af90949b587
Opcode Fuzzy Hash: 8edc7bd36405b16ebbc6cc3666236d9de2b87a26e9749873c2304ad168133898
Instruction Fuzzy Hash: 6811F2B5C003499FDB10DF9AD848ADEFBF4EB48324F10856AD428A3611D378A544CFA6

Function 07A1C670 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageA.USER32 ref: 07A1C6CD

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: ba7e56b2b1717053acb179eb2031a4c4faa05a58bfba132b8f48d1a01abe7260
Instruction ID: 5c4c33874299d4720902256dd2dc77c6d5695ac7a8ff1bfcfd8b3ec879a49297
Opcode Fuzzy Hash: ba7e56b2b1717053acb179eb2031a4c4faa05a58bfba132b8f48d1a01abe7260
Instruction Fuzzy Hash: 0311E2B5C007498FDB10DF9AD848BDEFBF4EB88324F10852AD429A3250D379A544CFA5

Function 07A11C88 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 07A11CE5

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 2b8c03ddb68f6dcaf27ee0e9c9b61e3ec8dc986dc4399e50bd4723ea1d9a1e88
Instruction ID: b5dbb2964da18a58d45b819398b5b0138a7839128c170bbf6c2019cc6361b508
Opcode Fuzzy Hash: 2b8c03ddb68f6dcaf27ee0e9c9b61e3ec8dc986dc4399e50bd4723ea1d9a1e88
Instruction Fuzzy Hash: 5B1112B5C007498FDB10DF9AD848BCEFBF4EB88324F10841AD529A3200C378A544CFA5

Function 011DD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968776195.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5625445bfa8098562bf7070dda08b1b1ffc89979bd5166763eec776cdf1307
Instruction ID: c8909ee752f2bc4d3f8a51095bedad598e521df23c4c440ce09b8e03f7f2e902
Opcode Fuzzy Hash: ea5625445bfa8098562bf7070dda08b1b1ffc89979bd5166763eec776cdf1307
Instruction Fuzzy Hash: F3210871504200DFDF09DF58E9C4B16BF75FB94318F648569D9090B296C336D456C7A2

Function 011DD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968776195.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d14c6bba4fe791d90a3c61c65e3a007bc8831a884ebed18efb578ae1563174f
Instruction ID: 0c4b38edeb292b4d775d6a7f2f6dee2baa0c7813bcbd65c5f964d357de866cc8
Opcode Fuzzy Hash: 2d14c6bba4fe791d90a3c61c65e3a007bc8831a884ebed18efb578ae1563174f
Instruction Fuzzy Hash: AC2128B1504200EFDF09DF98E9C0B66BF65FB94324F24C66DD9090B686C336E416C7A2

Function 011ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968841395.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb51d1d6bf1dbec02475fc8d098e371f426352fc551de19d95c47f0228b4cb62
Instruction ID: a807409baedb2b7d54e967e4b4ca52bcd32780ed3f908abada7a452a2b969e61
Opcode Fuzzy Hash: cb51d1d6bf1dbec02475fc8d098e371f426352fc551de19d95c47f0228b4cb62
Instruction Fuzzy Hash: C0210371604600DFCF19DF98E888B16BFA5FB84314F28C56DD80A0B242C336D407CA62

Function 011ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968841395.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b3541f382f80cdfa18f600523fd6bff5d9d5d4732197f0455a6d147e517f4b1
Instruction ID: f95309c03bab05066e2d013331f0cfc446aeba54965fece71916bb4f7b9e3643
Opcode Fuzzy Hash: 9b3541f382f80cdfa18f600523fd6bff5d9d5d4732197f0455a6d147e517f4b1
Instruction Fuzzy Hash: B721F875504601DFDF09DF94E5C8B15BBE5FB84324F24C56DE90A4B292C336D406CB62

Function 011ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968841395.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe21e9e4692e11a34e1bfae9c8aa9dae2b622cf6a755bc98d6154a9555fc037
Instruction ID: c9eb7fed26c0da5f2dab322d62863d1e7cc03ac072c5f4bea38aff2b63d9003b
Opcode Fuzzy Hash: bfe21e9e4692e11a34e1bfae9c8aa9dae2b622cf6a755bc98d6154a9555fc037
Instruction Fuzzy Hash: A921D4355093808FCB07CF64D994715BFB1FB46214F28C1DAD8498F2A3C33A980ACB62

Function 011DD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968776195.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: 3a3ab19da8495121bd50adeaa471d1d6a8af926a3fe40f1daf2576c5ad578f38
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: FB11B176504240DFDF16CF54D5C4B16BF72FB84324F24C6A9D9090B296C33AD45ACBA2

Function 011DD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968776195.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: 6f4980c51624edee27fa6f0880c2fe3d526ce9d42e3efb4c98c40e3044d1ae92
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: F811E176504240CFCF06CF44D5C4B56BF72FB84324F24C5A9D9090B696C33AE45ACBA2

Function 011ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968841395.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 394b701ad41cdfe51bbdfac22103b1564c5884ca656d56b1636d2d3d7fb1afcd
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 9511BB79904680DFDB06CF94D5C8B15FBB2FB84224F24C6ADD8494B296C33AD40ACB62

Function 011DD75D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968776195.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f06b81a3f135f0c6a408dbfa7d1d2422eeb058e3504fb2d262b09ce9716b10c
Instruction ID: cca9e810774af03088a66fc081e0fafac54add87e7742a2429be34cfec12eeba
Opcode Fuzzy Hash: 0f06b81a3f135f0c6a408dbfa7d1d2422eeb058e3504fb2d262b09ce9716b10c
Instruction Fuzzy Hash: 6801F7710047809EEB199A99EC84B67BFD8DF51329F19C89AED1D0A2C6C3789840C672

Function 011DD75C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2968776195.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f91db122555699d97dc90dcd2dc25612df7299c5b905d990afc2fb8523b8a74
Instruction ID: 2440bb8fd5be6264b5f4be0f95efe11c9ab64a6fdbea25577d5492db21cf3247
Opcode Fuzzy Hash: 0f91db122555699d97dc90dcd2dc25612df7299c5b905d990afc2fb8523b8a74
Instruction Fuzzy Hash: 8AF062724047849EEB158A1ADC84B63FF98EB51738F18C45AED584A2C7C379A844CA71

Non-executed Functions

Function 02D3C1B8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2969137242.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115a3f8edcb238e64f540ac80f05d036608f79adedf69718bfd0a5c956344373
Instruction ID: c41db2d570db1639eb7fbdbbb32d11ccbef6ec0a481592691be3d825181e319a
Opcode Fuzzy Hash: 115a3f8edcb238e64f540ac80f05d036608f79adedf69718bfd0a5c956344373
Instruction Fuzzy Hash: C1A14836A202198FCF06DFB4C88459EBBB2FF85704B15856AE805BB361DB35ED15CB90

Function 07A165C0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e246b6406ef4f2f3f9ffaa7153612b1703b085407b1b928e90248dce33f40c96
Instruction ID: cef77b1bb482ad7b95a621086cfc6cc12a6f9d304348caf9d924655121240a8d
Opcode Fuzzy Hash: e246b6406ef4f2f3f9ffaa7153612b1703b085407b1b928e90248dce33f40c96
Instruction Fuzzy Hash: 0F81B2B2E00609CEDB14DFA6D9442EDFBB6FF84340F14C13AD465A7658EB399616CB40

Function 07A160F8 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2972073735.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_Flash USDT Sender.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f72ea12c6e843326810969468f785f9e4fd27e8f447579dfca27d5bfd41da03
Instruction ID: db24c03a535f5d20e91f7bf7919d214e186c39a4f3570f0f928227c9864a26aa
Opcode Fuzzy Hash: 3f72ea12c6e843326810969468f785f9e4fd27e8f447579dfca27d5bfd41da03
Instruction Fuzzy Hash: 3881BEB2E00609CBCB04CFA6D8442EEFBB6FF84340F15C13AD556AB658EB359656CB40

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Flash USDT Sender.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: Flash USDT Sender.exePID: 7288, Parent PID: 2580

General

File Activities

File Opened

File Created

File Read

File Attributes Queried

Volume Information Queried

Device IO

Windows Analysis Report
Flash USDT Sender.exe

Function 07A13B30 Relevance: 5.3, Strings: 4, Instructions: 264
COMMON

Function 07A15448 Relevance: 3.2, Strings: 2, Instructions: 693
COMMON

Function 02D3D4C8 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Function 02D3C53C Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 02D3FE68 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Function 02D37780 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 02D37788 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 07A11588 Relevance: 1.6, APIs: 1, Instructions: 55
windowCOMMON

Function 07A117B0 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON