Edit tour

Windows Analysis Report
H3nfKrgQbi.exe

Overview

General Information

Sample name:	H3nfKrgQbi.exe
Analysis ID:	1515108
MD5:	1c5083792acfccf5d90db80884569ace
SHA1:	6be243663a2d173dcd728146f2a3d1a5a974ff38
SHA256:	27ca44d4fca5a29c0018efeebbda04250739a546e4b7879bd5a547aaea1de80d
Tags:	exeuser-aachum
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

H3nfKrgQbi.exe (PID: 7092 cmdline: "C:\Users\user\Desktop\H3nfKrgQbi.exe" MD5: 1C5083792ACFCCF5D90DB80884569ACE)

cmd.exe (PID: 6496 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bazwewbz\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1520 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wuefhdgm.exe" C:\Windows\SysWOW64\bazwewbz\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7156 cmdline: "C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 2684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6004 cmdline: "C:\Windows\System32\sc.exe" description bazwewbz "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7148 cmdline: "C:\Windows\System32\sc.exe" start bazwewbz MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 4984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1600 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 1996 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 1188 MD5: C31336C1EFC2CCB44B4326EA793040F2)

wuefhdgm.exe (PID: 5864 cmdline: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d"C:\Users\user\Desktop\H3nfKrgQbi.exe" MD5: E8162D23E2C2202690CEB6F6E48A723E)

svchost.exe (PID: 6496 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 6844 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 536 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 6416 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 1292 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5864 -ip 5864 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1352 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 7092 -ip 7092 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 1892 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.2105550467.0000000002528000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10003:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2105496878.00000000024DD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1037b:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: H3nfKrgQbi.exe PID: 7092	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: wuefhdgm.exe PID: 5864	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 6496	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.H3nfKrgQbi.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.H3nfKrgQbi.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.H3nfKrgQbi.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.wuefhdgm.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.wuefhdgm.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.wuefhdgm.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.wuefhdgm.exe.2d80000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.wuefhdgm.exe.2d80000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.H3nfKrgQbi.exe.25c0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.H3nfKrgQbi.exe.25c0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.H3nfKrgQbi.exe.24a0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.H3nfKrgQbi.exe.24a0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.H3nfKrgQbi.exe.24a0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.wuefhdgm.exe.2de0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.wuefhdgm.exe.2de0000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.wuefhdgm.exe.2de0000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.H3nfKrgQbi.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.H3nfKrgQbi.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.H3nfKrgQbi.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.H3nfKrgQbi.exe.24a0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.H3nfKrgQbi.exe.24a0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.wuefhdgm.exe.24f0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.wuefhdgm.exe.24f0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.wuefhdgm.exe.2de0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
13.2.svchost.exe.2780000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.wuefhdgm.exe.2de0000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
13.2.svchost.exe.2780000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.wuefhdgm.exe.2de0000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
13.2.svchost.exe.2780000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.H3nfKrgQbi.exe.25c0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.H3nfKrgQbi.exe.25c0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.H3nfKrgQbi.exe.25c0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.wuefhdgm.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.wuefhdgm.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.wuefhdgm.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.wuefhdgm.exe.2d80000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.3.wuefhdgm.exe.2d80000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.wuefhdgm.exe.2d80000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
13.2.svchost.exe.2780000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
13.2.svchost.exe.2780000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
13.2.svchost.exe.2780000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.wuefhdgm.exe.24f0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.wuefhdgm.exe.24f0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.wuefhdgm.exe.24f0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d"C:\Users\user\Desktop\H3nfKrgQbi.exe", ParentImage: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, ParentProcessId: 5864, ParentProcessName: wuefhdgm.exe, ProcessCommandLine: svchost.exe, ProcessId: 6496, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\H3nfKrgQbi.exe", ParentImage: C:\Users\user\Desktop\H3nfKrgQbi.exe, ParentProcessId: 7092, ParentProcessName: H3nfKrgQbi.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7156, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.42.0, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 6496, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d"C:\Users\user\Desktop\H3nfKrgQbi.exe", ParentImage: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, ParentProcessId: 5864, ParentProcessName: wuefhdgm.exe, ProcessCommandLine: svchost.exe, ProcessId: 6496, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 6496, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\bazwewbz

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\H3nfKrgQbi.exe", ParentImage: C:\Users\user\Desktop\H3nfKrgQbi.exe, ParentProcessId: 7092, ParentProcessName: H3nfKrgQbi.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7156, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 6416, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: vanaheim.cn:443	Avira URL Cloud: Label: phishing
Source: jotunheim.name:443	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.H3nfKrgQbi.exe.24a0e67.1.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for domain / URL

Source: vanaheim.cn	Virustotal: Detection: 15%	Perma Link
Source: jotunheim.name:443	Virustotal: Detection: 12%	Perma Link
Source: vanaheim.cn:443	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for submitted file

Source: H3nfKrgQbi.exe	ReversingLabs: Detection: 44%
Source: H3nfKrgQbi.exe	Virustotal: Detection: 44%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\wuefhdgm.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: H3nfKrgQbi.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Unpacked PE file: 0.2.H3nfKrgQbi.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Unpacked PE file: 12.2.wuefhdgm.exe.400000.0.unpack

Source: H3nfKrgQbi.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\bazwewbz

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.42.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.79 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.251.173.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.58.54.132 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.42.0 52.101.42.0
Source: Joe Sandbox View	IP Address: 67.195.204.79 67.195.204.79
Source: Joe Sandbox View	IP Address: 94.100.180.31 94.100.180.31

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: YAHOO-3US YAHOO-3US
Source: Joe Sandbox View	ASN Name: URALTRANSCOM-ASUA URALTRANSCOM-ASUA
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU

Source: global traffic	TCP traffic: 192.168.2.5:49705 -> 52.101.42.0:25
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 67.195.204.79:25
Source: global traffic	TCP traffic: 192.168.2.5:49932 -> 142.251.173.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49934 -> 94.100.180.31:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 0.2.H3nfKrgQbi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.H3nfKrgQbi.exe.24a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.2de0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.H3nfKrgQbi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.2de0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.H3nfKrgQbi.exe.25c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.wuefhdgm.exe.2d80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2780000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: H3nfKrgQbi.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wuefhdgm.exe PID: 5864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6496, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.H3nfKrgQbi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.H3nfKrgQbi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.wuefhdgm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.wuefhdgm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.wuefhdgm.exe.2d80000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.wuefhdgm.exe.2d80000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.H3nfKrgQbi.exe.25c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.H3nfKrgQbi.exe.25c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.H3nfKrgQbi.exe.24a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.H3nfKrgQbi.exe.24a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.wuefhdgm.exe.2de0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.wuefhdgm.exe.2de0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.H3nfKrgQbi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.H3nfKrgQbi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.H3nfKrgQbi.exe.24a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.H3nfKrgQbi.exe.24a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.wuefhdgm.exe.24f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.wuefhdgm.exe.24f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.wuefhdgm.exe.2de0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 13.2.svchost.exe.2780000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.wuefhdgm.exe.2de0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 13.2.svchost.exe.2780000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.H3nfKrgQbi.exe.25c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.H3nfKrgQbi.exe.25c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.wuefhdgm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.wuefhdgm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.wuefhdgm.exe.2d80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.wuefhdgm.exe.2d80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 13.2.svchost.exe.2780000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 13.2.svchost.exe.2780000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.wuefhdgm.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.wuefhdgm.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2105550467.0000000002528000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2105496878.00000000024DD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\bazwewbz\

Jump to behavior

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Code function: 12_2_0040C913	12_2_0040C913
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Code function: 12_2_02528129	12_2_02528129
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0278C913	13_2_0278C913

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Code function: String function: 024A27AB appears 35 times
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5864 -ip 5864

Source: H3nfKrgQbi.exe, 00000000.00000002.2105548519.000000000258F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameCmd.Exej% vs H3nfKrgQbi.exe

Source: H3nfKrgQbi.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.H3nfKrgQbi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.H3nfKrgQbi.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.wuefhdgm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.wuefhdgm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.wuefhdgm.exe.2d80000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.wuefhdgm.exe.2d80000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.H3nfKrgQbi.exe.25c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.H3nfKrgQbi.exe.25c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.H3nfKrgQbi.exe.24a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.H3nfKrgQbi.exe.24a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.wuefhdgm.exe.2de0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.wuefhdgm.exe.2de0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.H3nfKrgQbi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.H3nfKrgQbi.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.H3nfKrgQbi.exe.24a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.H3nfKrgQbi.exe.24a0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.wuefhdgm.exe.24f0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.wuefhdgm.exe.24f0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.wuefhdgm.exe.2de0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 13.2.svchost.exe.2780000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.wuefhdgm.exe.2de0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 13.2.svchost.exe.2780000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.H3nfKrgQbi.exe.25c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.H3nfKrgQbi.exe.25c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.wuefhdgm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.wuefhdgm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.wuefhdgm.exe.2d80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.wuefhdgm.exe.2d80000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 13.2.svchost.exe.2780000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 13.2.svchost.exe.2780000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.wuefhdgm.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.wuefhdgm.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2105550467.0000000002528000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2105496878.00000000024DD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: H3nfKrgQbi.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@32/3@11/5

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_024ED3A9 CreateToolhelp32Snapshot,Module32First,

0_2_024ED3A9

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_02789A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	13_2_02789A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6204:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:1352:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:1292:64:WilError_03

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

File created: C:\Users\user\AppData\Local\Temp\wuefhdgm.exe

Jump to behavior

Source: H3nfKrgQbi.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: H3nfKrgQbi.exe	ReversingLabs: Detection: 44%
Source: H3nfKrgQbi.exe	Virustotal: Detection: 44%

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

File read: C:\Users\user\Desktop\H3nfKrgQbi.exe

Jump to behavior

Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_12-14976
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_0-14835

Source: unknown	Process created: C:\Users\user\Desktop\H3nfKrgQbi.exe "C:\Users\user\Desktop\H3nfKrgQbi.exe"
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bazwewbz\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wuefhdgm.exe" C:\Windows\SysWOW64\bazwewbz\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description bazwewbz "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start bazwewbz
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d"C:\Users\user\Desktop\H3nfKrgQbi.exe"
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5864 -ip 5864
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 7092 -ip 7092
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 1188
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 536
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bazwewbz\	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wuefhdgm.exe" C:\Windows\SysWOW64\bazwewbz\	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description bazwewbz "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start bazwewbz	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5864 -ip 5864	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 7092 -ip 7092	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 1188	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 536	Jump to behavior

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: H3nfKrgQbi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Unpacked PE file: 0.2.H3nfKrgQbi.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Unpacked PE file: 12.2.wuefhdgm.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Unpacked PE file: 0.2.H3nfKrgQbi.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Unpacked PE file: 12.2.wuefhdgm.exe.400000.0.unpack

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Code function: 0_2_024F0691 push 0000002Bh; iretd		0_2_024F0697
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Code function: 12_2_0253B319 push 0000002Bh; iretd		12_2_0253B31F

Source: H3nfKrgQbi.exe

Static PE information: section name: .text entropy: 7.876885992304956

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe (copy)			Jump to dropped file
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	File created: C:\Users\user\AppData\Local\Temp\wuefhdgm.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bazwewbz

Jump to behavior

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\h3nfkrgqbi.exe

Jump to behavior

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

13_2_0278199C

Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-15824
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15285
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_13-7610

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_13-6147

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_13-6435
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-15275
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-15349

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_0-15021
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_13-7450

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_0-14849
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_13-6177
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_12-14991

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	API coverage: 5.5 %
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	API coverage: 4.0 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 2684	Thread sleep count: 39 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 2684	Thread sleep time: -39000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 0000000D.00000002.3322886497.0000000002C00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	API call chain: ExitProcess graph end node			graph_12-15361
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node			graph_13-6181

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_13-7672
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_12-16368

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Code function: 0_2_024A092B mov eax, dword ptr fs:[00000030h]	0_2_024A092B
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Code function: 0_2_024A0D90 mov eax, dword ptr fs:[00000030h]	0_2_024A0D90
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Code function: 0_2_024ECC86 push dword ptr fs:[00000030h]	0_2_024ECC86
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Code function: 12_2_024F092B mov eax, dword ptr fs:[00000030h]	12_2_024F092B
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Code function: 12_2_024F0D90 mov eax, dword ptr fs:[00000030h]	12_2_024F0D90
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Code function: 12_2_0253790E push dword ptr fs:[00000030h]	12_2_0253790E

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_02789A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	13_2_02789A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.42.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.79 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.251.173.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.58.54.132 443	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2780000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2780000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2780000			Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2956008			Jump to behavior

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bazwewbz\	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wuefhdgm.exe" C:\Windows\SysWOW64\bazwewbz\	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description bazwewbz "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start bazwewbz	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5864 -ip 5864	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 7092 -ip 7092	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 1188	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 536	Jump to behavior

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

0_2_00407809

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 0.2.H3nfKrgQbi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.H3nfKrgQbi.exe.24a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.2de0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.H3nfKrgQbi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.2de0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.H3nfKrgQbi.exe.25c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.wuefhdgm.exe.2d80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2780000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: H3nfKrgQbi.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wuefhdgm.exe PID: 5864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6496, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 0.2.H3nfKrgQbi.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.H3nfKrgQbi.exe.24a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.2de0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.H3nfKrgQbi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.2de0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.H3nfKrgQbi.exe.25c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.wuefhdgm.exe.2d80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2780000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.wuefhdgm.exe.24f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: H3nfKrgQbi.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wuefhdgm.exe PID: 5864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6496, type: MEMORYSTR

Source: C:\Users\user\Desktop\H3nfKrgQbi.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe	Code function: 12_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_027888B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	13_2_027888B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	22 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
H3nfKrgQbi.exe	45%	ReversingLabs	Win32.Trojan.Cerbu
H3nfKrgQbi.exe	44%	Virustotal		Browse
H3nfKrgQbi.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\wuefhdgm.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
mxs.mail.ru	0%	Virustotal	Browse
mta5.am0.yahoodns.net	0%	Virustotal	Browse
microsoft-com.mail.protection.outlook.com	0%	Virustotal	Browse
vanaheim.cn	16%	Virustotal	Browse
smtp.google.com	0%	Virustotal	Browse
google.com	0%	Virustotal	Browse
mail.ru	0%	Virustotal	Browse
yahoo.com	0%	Virustotal	Browse
18.31.95.13.in-addr.arpa	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
jotunheim.name:443	13%	Virustotal		Browse
vanaheim.cn:443	100%	Avira URL Cloud	phishing
jotunheim.name:443	100%	Avira URL Cloud	malware
vanaheim.cn:443	8%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mxs.mail.ru	94.100.180.31	true	true	0%, Virustotal, Browse	unknown
mta5.am0.yahoodns.net	67.195.204.79	true	true	0%, Virustotal, Browse	unknown
microsoft-com.mail.protection.outlook.com	52.101.42.0	true	true	0%, Virustotal, Browse	unknown
vanaheim.cn	195.58.54.132	true	true	16%, Virustotal, Browse	unknown
smtp.google.com	142.251.173.27	true	false	0%, Virustotal, Browse	unknown
google.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
18.31.95.13.in-addr.arpa	unknown	unknown	true	0%, Virustotal, Browse	unknown
yahoo.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
mail.ru	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	8%, Virustotal, Browse Avira URL Cloud: phishing	unknown
jotunheim.name:443	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.101.42.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
67.195.204.79	mta5.am0.yahoodns.net	United States	26101	YAHOO-3US	true
142.251.173.27	smtp.google.com	United States	15169	GOOGLEUS	false
195.58.54.132	vanaheim.cn	Russian Federation	41082	URALTRANSCOM-ASUA	true
94.100.180.31	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1515108
Start date and time:	2024-09-21 17:15:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	H3nfKrgQbi.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@32/3@11/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 61 Number of non-executed functions: 259
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.231.239.246, 20.236.44.162, 20.112.250.133, 20.76.201.171, 20.70.246.20
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:16:51	API Interceptor	12x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.42.0	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse
	.exe	Get hash	malicious	Unknown	Browse
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse
67.195.204.79	vekvtia.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse
	7b8wRbnmKu.exe	Get hash	malicious	Unknown	Browse
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	data.log.exe	Get hash	malicious	Unknown	Browse
	message.elm.exe	Get hash	malicious	Unknown	Browse
	Update-KB6734-x86.exe	Get hash	malicious	Unknown	Browse
94.100.180.31	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse
	vekvtia.exe	Get hash	malicious	Tofsee	Browse
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
	setup.exe	Get hash	malicious	Tofsee	Browse
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Trojan-Ransom.StopCrypt.22110.437.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mxs.mail.ru	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
mta5.am0.yahoodns.net	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	67.195.204.72
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.74
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.77
vanaheim.cn	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
microsoft-com.mail.protection.outlook.com	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	52.101.11.9
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
URALTRANSCOM-ASUA	cQOoKCZyG3.elf	Get hash	malicious	Mirai	Browse	91.215.129.108
	09M6JXwjtO.elf	Get hash	malicious	Mirai	Browse	195.133.84.147
	Pb0GaINSjK.elf	Get hash	malicious	Mirai	Browse	194.87.3.81
	QN5PrDr5St.elf	Get hash	malicious	Unknown	Browse	195.133.84.180
	8dToMPcvO1.elf	Get hash	malicious	Mirai	Browse	91.215.129.145
	wsskM49eA3.elf	Get hash	malicious	Unknown	Browse	195.133.89.28
	quhEKAdhFU.elf	Get hash	malicious	Mirai	Browse	91.215.129.137
	5z7qDyLr2T.elf	Get hash	malicious	Mirai	Browse	91.215.129.142
	NwB5j32x4j.elf	Get hash	malicious	Mirai	Browse	91.215.129.123
	jklarm.elf	Get hash	malicious	Mirai	Browse	91.215.129.126
MICROSOFT-CORP-MSN-AS-BLOCKUS	Ordem de Compra 457525.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	Copy0761000025.xlsm	Get hash	malicious	Unknown	Browse	13.107.253.72
	rPO767575.cmd	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	160eb3d41a49c24b1ba025424b781ddf3acb8979ffb90269b6a0f701be0c3dfa.25.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	160eb3d41a49c24b1ba025424b781ddf3acb8979ffb90269b6a0f701be0c3dfa.24.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	8zzBr1gT31.elf	Get hash	malicious	Mirai	Browse	22.112.76.125
	160eb3d41a49c24b1ba025424b781ddf3acb8979ffb90269b6a0f701be0c3dfa.23.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	GyFcTadTZv.elf	Get hash	malicious	Mirai	Browse	13.83.227.6
	iZP1hJhnmz.elf	Get hash	malicious	Mirai	Browse	22.204.62.58
	dAlxfXyNm7.elf	Get hash	malicious	Mirai	Browse	20.104.105.19
YAHOO-3US	https://nke.pages.dev/account/js-reporting/?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=/account/challenge/password	Get hash	malicious	HTMLPhisher	Browse	66.218.84.43
	https://www.google.com/url?q=https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wD5CHARyycT&sa=t&esrc=2Dv8p65dFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fcells2go.co%2Fone%2F.me%2FCy0cxTT1O745SqR1gfrta/ZGFycmVuLmhvbG1lc0BwZXJyeWhvbWVzLmNvb	Get hash	malicious	HTMLPhisher	Browse	74.6.143.26
	https://www.getcoloringpages.com/coloring/359	Get hash	malicious	Unknown	Browse	67.195.204.151
	http://opm.pages.dev/account/js-reporting?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=/account/challenge/password	Get hash	malicious	HTMLPhisher	Browse	66.218.87.15
	http://jss.pages.dev/account/js-reporting?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=/account/challenge/password	Get hash	malicious	HTMLPhisher	Browse	66.218.84.43
	https://uAa.iancendit.com/9uCUGa/K%7BEmail%7D	Get hash	malicious	HTMLPhisher	Browse	74.6.143.26
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	67.195.204.74
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	67.195.204.79
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	67.195.204.77
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse	67.195.204.77
MAILRU-ASMailRuRU	8zzBr1gT31.elf	Get hash	malicious	Mirai	Browse	5.61.23.57
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	OuZGkt7xKK.exe	Get hash	malicious	Coinhive, Xmrig	Browse	178.237.20.50
	OuZGkt7xKK.exe	Get hash	malicious	Coinhive, Xmrig	Browse	178.237.20.50
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31

Process:	C:\Users\user\Desktop\H3nfKrgQbi.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13548032
Entropy (8bit):	5.249826358334154
Encrypted:	false
SSDEEP:	98304:nOMSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZR:O
MD5:	E8162D23E2C2202690CEB6F6E48A723E
SHA1:	47E0DA90AD99A4823FA5A800CAD0E8661B19F2F5
SHA-256:	BF6A0847BA307D698A9655BB00B68923806DFC95497A9D14C2426902B973E461
SHA-512:	78E1330841312D920F1FA4BDEA784A0D1B3C85068BF80AA2900D219A168AAA1FFC29CD9139F6174C31055DD1717EA84D679C684703399C293341E9135AD4C6FE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C...........h.J....h......h.K.R....r...........h.N....h.{....h.\|....Rich...................PE..L....`.e.................L...........@.......`....@..........................................................................O..d.......(...........................hO..............................(+..@...............$............................text....K.......L.................. ..`.data........`...Z...P..............@....rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13548032
Entropy (8bit):	5.249826358334154
Encrypted:	false
SSDEEP:	98304:nOMSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZSZR:O
MD5:	E8162D23E2C2202690CEB6F6E48A723E
SHA1:	47E0DA90AD99A4823FA5A800CAD0E8661B19F2F5
SHA-256:	BF6A0847BA307D698A9655BB00B68923806DFC95497A9D14C2426902B973E461
SHA-512:	78E1330841312D920F1FA4BDEA784A0D1B3C85068BF80AA2900D219A168AAA1FFC29CD9139F6174C31055DD1717EA84D679C684703399C293341E9135AD4C6FE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C...........h.J....h......h.K.R....r...........h.N....h.{....h.\|....Rich...................PE..L....`.e.................L...........@.......`....@..........................................................................O..d.......(...........................hO..............................(+..@...............$............................text....K.......L.................. ..`.data........`...Z...P..............@....rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.762603190470854
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	H3nfKrgQbi.exe
File size:	424'960 bytes
MD5:	1c5083792acfccf5d90db80884569ace
SHA1:	6be243663a2d173dcd728146f2a3d1a5a974ff38
SHA256:	27ca44d4fca5a29c0018efeebbda04250739a546e4b7879bd5a547aaea1de80d
SHA512:	8af309adcaed0055ca8b2c879a1ff16e9d0d853ab3837c94719d09c03bf27b32125581f525ef99caa4488b184bfc5565b033333cd4af9e4240aa23963dd76a1b
SSDEEP:	6144:+nhYTBI6ONsWWqOaejSlD8viNV43Km3Wlz8+5FXCnFk:2aTy6OlO3GDyYnSC
TLSH:	81948E6242B17C45F9224F728E1ED6E9365FF9608D19772E221CAA3F25713F2C163B24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C...............h.J.....h.......h.K.R.....r.............h.N.....h.{.....h.\|.....Rich....................PE..L....`.e...........

File Icon


Icon Hash:	532555554545610d

Static PE Info

General

Entrypoint:	0x40409f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x65D960A8 [Sat Feb 24 03:21:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	aa1df04aa31b8b76e6674a21e4ac0295

Entrypoint Preview

Instruction
call 00007F1C44862565h
jmp 00007F1C4486040Eh
mov eax, 00436008h
ret
mov eax, dword ptr [02450C60h]
push esi
push 00000014h
pop esi
test eax, eax
jne 00007F1C44860589h
mov eax, 00000200h
jmp 00007F1C44860588h
cmp eax, esi
jnl 00007F1C44860589h
mov eax, esi
mov dword ptr [02450C60h], eax
push 00000004h
push eax
call 00007F1C44862613h
pop ecx
pop ecx
mov dword ptr [0244FC40h], eax
test eax, eax
jne 00007F1C448605A0h
push 00000004h
push esi
mov dword ptr [02450C60h], esi
call 00007F1C448625FAh
pop ecx
pop ecx
mov dword ptr [0244FC40h], eax
test eax, eax
jne 00007F1C44860587h
push 0000001Ah
pop eax
pop esi
ret
xor edx, edx
mov ecx, 00436008h
jmp 00007F1C44860587h
mov eax, dword ptr [0244FC40h]
mov dword ptr [edx+eax], ecx
add ecx, 20h
add edx, 04h
cmp ecx, 00436288h
jl 00007F1C4486056Ch
push FFFFFFFEh
pop esi
xor edx, edx
mov ecx, 00436018h
push edi
mov eax, edx
sar eax, 05h
mov eax, dword ptr [0244FB40h+eax*4]
mov edi, edx
and edi, 1Fh
shl edi, 06h
mov eax, dword ptr [edi+eax]
cmp eax, FFFFFFFFh
je 00007F1C4486058Ah
cmp eax, esi
je 00007F1C44860586h
test eax, eax
jne 00007F1C44860584h
mov dword ptr [ecx], esi
add ecx, 20h
inc edx
cmp ecx, 00436078h
jl 00007F1C44860550h
pop edi
xor eax, eax
pop esi
ret
call 00007F1C44862844h
cmp byte ptr [00000000h], 00000000h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34f04	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2051000	0x2d128	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x34f68	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2b28	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x224	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x34b8c	0x34c00	b5c820cd68b3873502899a56e26fc4bb	False	0.9168348267180095	data	7.876885992304956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x36000	0x201ac84	0x5a00	6a292b15a937d27e3a5fed2ef76ed323	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2051000	0x2d128	0x2d200	af7195b1ee32d304a2455e85658a513c	False	0.4510907202216066	data	5.184601260526752	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PAMIYUYOVELURASEYOKODIJEBAWABIBO	0x2078ac8	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	India	0.5899857678871782
PAMIYUYOVELURASEYOKODIJEBAWABIBO	0x2078ac8	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	Sri Lanka	0.5899857678871782
ZEZEJEFIJICEDORIJ	0x2077758	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	India	0.5917587939698492
ZEZEJEFIJICEDORIJ	0x2077758	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	Sri Lanka	0.5917587939698492
RT_CURSOR	0x207a938	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x207b7e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x207c088	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_ICON	0x2051d50	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.43336886993603413
RT_ICON	0x2051d50	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.43336886993603413
RT_ICON	0x2052bf8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5397111913357401
RT_ICON	0x2052bf8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5397111913357401
RT_ICON	0x20534a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6059907834101382
RT_ICON	0x20534a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6059907834101382
RT_ICON	0x2053b68	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6770231213872833
RT_ICON	0x2053b68	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6770231213872833
RT_ICON	0x20540d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.33184647302904563
RT_ICON	0x20540d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.33184647302904563
RT_ICON	0x2056678	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	India	0.4075984990619137
RT_ICON	0x2056678	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	Sri Lanka	0.4075984990619137
RT_ICON	0x2057720	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	India	0.47295081967213115
RT_ICON	0x2057720	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	Sri Lanka	0.47295081967213115
RT_ICON	0x20580a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.5531914893617021
RT_ICON	0x20580a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.5531914893617021
RT_ICON	0x2058588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.3662046908315565
RT_ICON	0x2058588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.3662046908315565
RT_ICON	0x2059430	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.45216606498194944
RT_ICON	0x2059430	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.45216606498194944
RT_ICON	0x2059cd8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.4573732718894009
RT_ICON	0x2059cd8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.4573732718894009
RT_ICON	0x205a3a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.4588150289017341
RT_ICON	0x205a3a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.4588150289017341
RT_ICON	0x205a908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2697095435684647
RT_ICON	0x205a908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2697095435684647
RT_ICON	0x205ceb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.3074577861163227
RT_ICON	0x205ceb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.3074577861163227
RT_ICON	0x205df58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.35726950354609927
RT_ICON	0x205df58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.35726950354609927
RT_ICON	0x205e428	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.5676972281449894
RT_ICON	0x205e428	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.5676972281449894
RT_ICON	0x205f2d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5478339350180506
RT_ICON	0x205f2d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5478339350180506
RT_ICON	0x205fb78	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.6163294797687862
RT_ICON	0x205fb78	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.6163294797687862
RT_ICON	0x20600e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.462344398340249
RT_ICON	0x20600e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.462344398340249
RT_ICON	0x2062688	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.48874296435272047
RT_ICON	0x2062688	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.48874296435272047
RT_ICON	0x2063730	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.49508196721311476
RT_ICON	0x2063730	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.49508196721311476
RT_ICON	0x20640b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.44858156028368795
RT_ICON	0x20640b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.44858156028368795
RT_ICON	0x2064588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.39152452025586354
RT_ICON	0x2064588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.39152452025586354
RT_ICON	0x2065430	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5144404332129964
RT_ICON	0x2065430	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5144404332129964
RT_ICON	0x2065cd8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5783410138248848
RT_ICON	0x2065cd8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5783410138248848
RT_ICON	0x20663a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.5823699421965318
RT_ICON	0x20663a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.5823699421965318
RT_ICON	0x2066908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.3878630705394191
RT_ICON	0x2066908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.3878630705394191
RT_ICON	0x2068eb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.42964352720450283
RT_ICON	0x2068eb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.42964352720450283
RT_ICON	0x2069f58	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.4151639344262295
RT_ICON	0x2069f58	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.4151639344262295
RT_ICON	0x206a8e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.48847517730496454
RT_ICON	0x206a8e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.48847517730496454
RT_ICON	0x206adc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.48933901918976547
RT_ICON	0x206adc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.48933901918976547
RT_ICON	0x206bc68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.46886281588447654
RT_ICON	0x206bc68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.46886281588447654
RT_ICON	0x206c510	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.434971098265896
RT_ICON	0x206c510	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.434971098265896
RT_ICON	0x206ca78	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.27977178423236515
RT_ICON	0x206ca78	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.27977178423236515
RT_ICON	0x206f020	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2903377110694184
RT_ICON	0x206f020	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2903377110694184
RT_ICON	0x20700c8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.31024590163934423
RT_ICON	0x20700c8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.31024590163934423
RT_ICON	0x2070a50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3377659574468085
RT_ICON	0x2070a50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3377659574468085
RT_ICON	0x2070f20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.3829957356076759
RT_ICON	0x2070f20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.3829957356076759
RT_ICON	0x2071dc8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5424187725631769
RT_ICON	0x2071dc8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5424187725631769
RT_ICON	0x2072670	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6215437788018433
RT_ICON	0x2072670	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6215437788018433
RT_ICON	0x2072d38	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6596820809248555
RT_ICON	0x2072d38	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6596820809248555
RT_ICON	0x20732a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.5139004149377593
RT_ICON	0x20732a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.5139004149377593
RT_ICON	0x2075848	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.5382270168855535
RT_ICON	0x2075848	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.5382270168855535
RT_ICON	0x20768f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.5217213114754098
RT_ICON	0x20768f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.5217213114754098
RT_ICON	0x2077278	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.5815602836879432
RT_ICON	0x2077278	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.5815602836879432
RT_STRING	0x207c878	0x506	data	Tamil	India	0.44712286158631415
RT_STRING	0x207c878	0x506	data	Tamil	Sri Lanka	0.44712286158631415
RT_STRING	0x207cd80	0x6fa	data	Tamil	India	0.4232922732362822
RT_STRING	0x207cd80	0x6fa	data	Tamil	Sri Lanka	0.4232922732362822
RT_STRING	0x207d480	0x2cc	data	Tamil	India	0.48463687150837986
RT_STRING	0x207d480	0x2cc	data	Tamil	Sri Lanka	0.48463687150837986
RT_STRING	0x207d750	0x606	data	Tamil	India	0.4383916990920882
RT_STRING	0x207d750	0x606	data	Tamil	Sri Lanka	0.4383916990920882
RT_STRING	0x207dd58	0x3cc	data	Tamil	India	0.45267489711934156
RT_STRING	0x207dd58	0x3cc	data	Tamil	Sri Lanka	0.45267489711934156
RT_ACCELERATOR	0x207a900	0x38	data	Tamil	India	0.9107142857142857
RT_ACCELERATOR	0x207a900	0x38	data	Tamil	Sri Lanka	0.9107142857142857
RT_GROUP_CURSOR	0x207c5f0	0x30	data			0.9375
RT_GROUP_ICON	0x2064520	0x68	data	Tamil	India	0.7115384615384616
RT_GROUP_ICON	0x2064520	0x68	data	Tamil	Sri Lanka	0.7115384615384616
RT_GROUP_ICON	0x2058510	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x2058510	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_GROUP_ICON	0x205e3c0	0x68	data	Tamil	India	0.7115384615384616
RT_GROUP_ICON	0x205e3c0	0x68	data	Tamil	Sri Lanka	0.7115384615384616
RT_GROUP_ICON	0x206ad48	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x206ad48	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_GROUP_ICON	0x20776e0	0x76	data	Tamil	India	0.6864406779661016
RT_GROUP_ICON	0x20776e0	0x76	data	Tamil	Sri Lanka	0.6864406779661016
RT_GROUP_ICON	0x2070eb8	0x68	data	Tamil	India	0.7019230769230769
RT_GROUP_ICON	0x2070eb8	0x68	data	Tamil	Sri Lanka	0.7019230769230769
RT_VERSION	0x207c620	0x254	data			0.5436241610738255

Imports

DLL	Import
KERNEL32.dll	InterlockedDecrement, GetCurrentProcess, InterlockedCompareExchange, SetVolumeMountPointW, CreateHardLinkA, GetModuleHandleW, CreateNamedPipeW, EnumCalendarInfoExW, GetNumberFormatA, CreateActCtxW, TlsSetValue, LoadLibraryW, GetLocaleInfoW, GetCalendarInfoA, CreateEventA, GetFileAttributesA, GetTimeFormatW, GetModuleFileNameW, FindNextVolumeMountPointW, GetTempPathW, GetShortPathNameA, CreateJobObjectA, VerifyVersionInfoW, InterlockedExchange, GlobalUnfix, GetLogicalDriveStringsA, GetLastError, GetCurrentDirectoryW, GetProcAddress, GetLongPathNameA, PeekConsoleInputW, EnumSystemCodePagesW, GetConsoleDisplayMode, SetComputerNameA, GetCommState, GetProcessVersion, SetThreadPriorityBoost, InterlockedExchangeAdd, CreateFileMappingA, LocalAlloc, GetFileType, FoldStringW, SetEnvironmentVariableA, EnumDateFormatsA, GetProcessShutdownParameters, LoadLibraryExA, VirtualProtect, GetFileTime, WaitForDebugEvent, OpenEventW, SetFileShortNameA, GetVersionExA, GetDiskFreeSpaceExW, GetWindowsDirectoryW, LocalFree, LCMapStringW, CommConfigDialogW, CloseHandle, GetStringTypeW, CreateFileW, IsProcessorFeaturePresent, MultiByteToWideChar, WriteConsoleW, InterlockedIncrement, GetConsoleAliasExesLengthA, SetEndOfFile, GetConsoleAliasExesA, EnumCalendarInfoA, GlobalMemoryStatus, LoadModule, SetDefaultCommConfigA, SetStdHandle, FlushFileBuffers, HeapAlloc, HeapReAlloc, ExitProcess, DecodePointer, GetCommandLineW, HeapSetInformation, GetStartupInfoW, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, WriteFile, HeapCreate, HeapFree, TlsAlloc, TlsGetValue, TlsFree, SetLastError, GetCurrentThreadId, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, Sleep, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize
USER32.dll	DrawStateA, SetCaretPos, LoadMenuA, CharUpperA, GetMenu, InsertMenuItemW, GetWindowLongW, GetSysColor, GetMenuStringA
GDI32.dll	GetBkMode, GetCharWidthFloatA, CreateDCA, GetCharWidth32A, GetTextMetricsA, GetTextCharset, GetCharWidthI
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 21, 2024 17:16:10.205862999 CEST	49705	25	192.168.2.5	52.101.42.0
Sep 21, 2024 17:16:11.215965033 CEST	49705	25	192.168.2.5	52.101.42.0
Sep 21, 2024 17:16:12.944139957 CEST	49706	443	192.168.2.5	195.58.54.132
Sep 21, 2024 17:16:12.944241047 CEST	443	49706	195.58.54.132	192.168.2.5
Sep 21, 2024 17:16:12.944335938 CEST	49706	443	192.168.2.5	195.58.54.132
Sep 21, 2024 17:16:13.215941906 CEST	49705	25	192.168.2.5	52.101.42.0
Sep 21, 2024 17:16:17.215964079 CEST	49705	25	192.168.2.5	52.101.42.0
Sep 21, 2024 17:16:25.216008902 CEST	49705	25	192.168.2.5	52.101.42.0
Sep 21, 2024 17:16:30.232304096 CEST	49714	25	192.168.2.5	67.195.204.79
Sep 21, 2024 17:16:31.231663942 CEST	49714	25	192.168.2.5	67.195.204.79
Sep 21, 2024 17:16:33.247344017 CEST	49714	25	192.168.2.5	67.195.204.79
Sep 21, 2024 17:16:37.262929916 CEST	49714	25	192.168.2.5	67.195.204.79
Sep 21, 2024 17:16:45.278599024 CEST	49714	25	192.168.2.5	67.195.204.79
Sep 21, 2024 17:16:50.306384087 CEST	49932	25	192.168.2.5	142.251.173.27
Sep 21, 2024 17:16:51.309954882 CEST	49932	25	192.168.2.5	142.251.173.27
Sep 21, 2024 17:16:52.935004950 CEST	49706	443	192.168.2.5	195.58.54.132
Sep 21, 2024 17:16:52.935117960 CEST	443	49706	195.58.54.132	192.168.2.5
Sep 21, 2024 17:16:52.935249090 CEST	49706	443	192.168.2.5	195.58.54.132
Sep 21, 2024 17:16:53.053417921 CEST	49933	443	192.168.2.5	195.58.54.132
Sep 21, 2024 17:16:53.053447008 CEST	443	49933	195.58.54.132	192.168.2.5
Sep 21, 2024 17:16:53.053522110 CEST	49933	443	192.168.2.5	195.58.54.132
Sep 21, 2024 17:16:53.309983015 CEST	49932	25	192.168.2.5	142.251.173.27
Sep 21, 2024 17:16:57.309947014 CEST	49932	25	192.168.2.5	142.251.173.27
Sep 21, 2024 17:17:05.309945107 CEST	49932	25	192.168.2.5	142.251.173.27
Sep 21, 2024 17:17:10.310090065 CEST	49934	25	192.168.2.5	94.100.180.31
Sep 21, 2024 17:17:11.325793982 CEST	49934	25	192.168.2.5	94.100.180.31
Sep 21, 2024 17:17:13.341335058 CEST	49934	25	192.168.2.5	94.100.180.31
Sep 21, 2024 17:17:17.356898069 CEST	49934	25	192.168.2.5	94.100.180.31
Sep 21, 2024 17:17:25.356960058 CEST	49934	25	192.168.2.5	94.100.180.31
Sep 21, 2024 17:17:33.044723034 CEST	49933	443	192.168.2.5	195.58.54.132
Sep 21, 2024 17:17:33.044806004 CEST	443	49933	195.58.54.132	192.168.2.5
Sep 21, 2024 17:17:33.044969082 CEST	49933	443	192.168.2.5	195.58.54.132
Sep 21, 2024 17:17:33.154776096 CEST	49935	443	192.168.2.5	195.58.54.132
Sep 21, 2024 17:17:33.154879093 CEST	443	49935	195.58.54.132	192.168.2.5
Sep 21, 2024 17:17:33.154994011 CEST	49935	443	192.168.2.5	195.58.54.132

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 21, 2024 17:16:09.945190907 CEST	50355	53	192.168.2.5	1.1.1.1
Sep 21, 2024 17:16:10.192397118 CEST	53	50355	1.1.1.1	192.168.2.5
Sep 21, 2024 17:16:12.935652018 CEST	61224	53	192.168.2.5	1.1.1.1
Sep 21, 2024 17:16:12.943625927 CEST	53	61224	1.1.1.1	192.168.2.5
Sep 21, 2024 17:16:30.216813087 CEST	58564	53	192.168.2.5	1.1.1.1
Sep 21, 2024 17:16:30.223870993 CEST	53	58564	1.1.1.1	192.168.2.5
Sep 21, 2024 17:16:30.224750042 CEST	56270	53	192.168.2.5	1.1.1.1
Sep 21, 2024 17:16:30.231553078 CEST	53	56270	1.1.1.1	192.168.2.5
Sep 21, 2024 17:16:38.129618883 CEST	53	65193	162.159.36.2	192.168.2.5
Sep 21, 2024 17:16:38.761280060 CEST	53788	53	192.168.2.5	1.1.1.1
Sep 21, 2024 17:16:38.931525946 CEST	53	53788	1.1.1.1	192.168.2.5
Sep 21, 2024 17:16:50.247973919 CEST	56721	53	192.168.2.5	1.1.1.1
Sep 21, 2024 17:16:50.290038109 CEST	53	56721	1.1.1.1	192.168.2.5
Sep 21, 2024 17:16:50.295911074 CEST	59507	53	192.168.2.5	1.1.1.1
Sep 21, 2024 17:16:50.303103924 CEST	53	59507	1.1.1.1	192.168.2.5
Sep 21, 2024 17:16:53.044939041 CEST	62238	53	192.168.2.5	1.1.1.1
Sep 21, 2024 17:16:53.052836895 CEST	53	62238	1.1.1.1	192.168.2.5
Sep 21, 2024 17:17:10.295361996 CEST	54060	53	192.168.2.5	1.1.1.1
Sep 21, 2024 17:17:10.302165985 CEST	53	54060	1.1.1.1	192.168.2.5
Sep 21, 2024 17:17:10.302874088 CEST	49365	53	192.168.2.5	1.1.1.1
Sep 21, 2024 17:17:10.309432983 CEST	53	49365	1.1.1.1	192.168.2.5
Sep 21, 2024 17:18:11.630193949 CEST	59393	53	192.168.2.5	1.1.1.1
Sep 21, 2024 17:18:11.664124012 CEST	53	59393	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 21, 2024 17:16:09.945190907 CEST	192.168.2.5	1.1.1.1	0x4195	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:12.935652018 CEST	192.168.2.5	1.1.1.1	0xda29	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:30.216813087 CEST	192.168.2.5	1.1.1.1	0x3cee	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 17:16:30.224750042 CEST	192.168.2.5	1.1.1.1	0x716a	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:38.761280060 CEST	192.168.2.5	1.1.1.1	0x4cc4	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Sep 21, 2024 17:16:50.247973919 CEST	192.168.2.5	1.1.1.1	0x8cca	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 17:16:50.295911074 CEST	192.168.2.5	1.1.1.1	0x5515	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:53.044939041 CEST	192.168.2.5	1.1.1.1	0x35bf	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:17:10.295361996 CEST	192.168.2.5	1.1.1.1	0xa03e	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 17:17:10.302874088 CEST	192.168.2.5	1.1.1.1	0x4e9c	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:18:11.630193949 CEST	192.168.2.5	1.1.1.1	0x9ae8	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 21, 2024 17:16:10.192397118 CEST	1.1.1.1	192.168.2.5	0x4195	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.42.0	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:10.192397118 CEST	1.1.1.1	192.168.2.5	0x4195	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.40.26	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:10.192397118 CEST	1.1.1.1	192.168.2.5	0x4195	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.11.0	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:10.192397118 CEST	1.1.1.1	192.168.2.5	0x4195	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.8.49	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:12.943625927 CEST	1.1.1.1	192.168.2.5	0xda29	No error (0)	vanaheim.cn		195.58.54.132	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:30.223870993 CEST	1.1.1.1	192.168.2.5	0x3cee	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 17:16:30.223870993 CEST	1.1.1.1	192.168.2.5	0x3cee	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 17:16:30.223870993 CEST	1.1.1.1	192.168.2.5	0x3cee	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 17:16:30.231553078 CEST	1.1.1.1	192.168.2.5	0x716a	No error (0)	mta5.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:30.231553078 CEST	1.1.1.1	192.168.2.5	0x716a	No error (0)	mta5.am0.yahoodns.net		98.136.96.76	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:30.231553078 CEST	1.1.1.1	192.168.2.5	0x716a	No error (0)	mta5.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:30.231553078 CEST	1.1.1.1	192.168.2.5	0x716a	No error (0)	mta5.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:30.231553078 CEST	1.1.1.1	192.168.2.5	0x716a	No error (0)	mta5.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:30.231553078 CEST	1.1.1.1	192.168.2.5	0x716a	No error (0)	mta5.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:30.231553078 CEST	1.1.1.1	192.168.2.5	0x716a	No error (0)	mta5.am0.yahoodns.net		98.136.96.74	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:30.231553078 CEST	1.1.1.1	192.168.2.5	0x716a	No error (0)	mta5.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:38.931525946 CEST	1.1.1.1	192.168.2.5	0x4cc4	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Sep 21, 2024 17:16:50.290038109 CEST	1.1.1.1	192.168.2.5	0x8cca	No error (0)	google.com			MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 17:16:50.303103924 CEST	1.1.1.1	192.168.2.5	0x5515	No error (0)	smtp.google.com		142.251.173.27	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:50.303103924 CEST	1.1.1.1	192.168.2.5	0x5515	No error (0)	smtp.google.com		74.125.206.26	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:50.303103924 CEST	1.1.1.1	192.168.2.5	0x5515	No error (0)	smtp.google.com		74.125.206.27	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:50.303103924 CEST	1.1.1.1	192.168.2.5	0x5515	No error (0)	smtp.google.com		142.251.173.26	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:50.303103924 CEST	1.1.1.1	192.168.2.5	0x5515	No error (0)	smtp.google.com		64.233.167.27	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:16:53.052836895 CEST	1.1.1.1	192.168.2.5	0x35bf	No error (0)	vanaheim.cn		195.58.54.132	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:17:10.302165985 CEST	1.1.1.1	192.168.2.5	0xa03e	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 17:17:10.309432983 CEST	1.1.1.1	192.168.2.5	0x4e9c	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:17:10.309432983 CEST	1.1.1.1	192.168.2.5	0x4e9c	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:18:11.664124012 CEST	1.1.1.1	192.168.2.5	0x9ae8	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.11.0	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:18:11.664124012 CEST	1.1.1.1	192.168.2.5	0x9ae8	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.40.26	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:18:11.664124012 CEST	1.1.1.1	192.168.2.5	0x9ae8	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.42.0	A (IP address)	IN (0x0001)	false
Sep 21, 2024 17:18:11.664124012 CEST	1.1.1.1	192.168.2.5	0x9ae8	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.8.49	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:16:04
Start date:	21/09/2024
Path:	C:\Users\user\Desktop\H3nfKrgQbi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\H3nfKrgQbi.exe"
Imagebase:	0x400000
File size:	424'960 bytes
MD5 hash:	1C5083792ACFCCF5D90DB80884569ACE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2105496878.00000000024DD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.2071128241.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:16:05
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bazwewbz\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:16:05
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:16:05
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wuefhdgm.exe" C:\Windows\SysWOW64\bazwewbz\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:16:05
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:16:06
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create bazwewbz binPath= "C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d\"C:\Users\user\Desktop\H3nfKrgQbi.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0x750000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:16:06
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:16:06
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description bazwewbz "wifi internet conection"
Imagebase:	0x750000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:16:06
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:16:07
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start bazwewbz
Imagebase:	0x750000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:16:07
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:16:07
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe /d"C:\Users\user\Desktop\H3nfKrgQbi.exe"
Imagebase:	0x400000
File size:	13'548'032 bytes
MD5 hash:	E8162D23E2C2202690CEB6F6E48A723E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2105550467.0000000002528000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2105868697.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000003.2100698826.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:16:07
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x500000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	11:16:07
Start date:	21/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:16:07
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5864 -ip 5864
Imagebase:	0x110000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:16:07
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:16:07
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:16:07
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 7092 -ip 7092
Imagebase:	0x110000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:16:07
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 1188
Imagebase:	0x110000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:16:07
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 536
Imagebase:	0x110000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:16:50
Start date:	21/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	31%
Signature Coverage:	25.4%
Total number of Nodes:	1563
Total number of Limit Nodes:	18

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

\, xrefs: 00409D0C
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 0040A078
D, xrefs: 00409F8E
", xrefs: 0040A189
P, xrefs: 00409DAA
%X%08X, xrefs: 0040A0B0
", xrefs: 00409EDB

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 99d36be1cb1e2dd281c49b912807f1b416d9660fc9a6289a84b2fe52a19f9b2b
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 99d36be1cb1e2dd281c49b912807f1b416d9660fc9a6289a84b2fe52a19f9b2b
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID: PromptOnSecureDesktop
API String ID: 3188212458-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 024ED3A9 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 024ED3D1
Module32First.KERNEL32(00000000,00000224), ref: 024ED3F1

Memory Dump Source

Source File: 00000000.00000002.2105496878.00000000024DD000.00000040.00000020.00020000.00000000.sdmp, Offset: 024DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24dd000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: cd21b03b425250b1bce27a6ac30f15a619336a0634bb033de36073d177bd47fb
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: C0F0C231900714EBEB202BB5A88CB6F72ECAF48626F10152AE643D11C0CBB0E8054A60

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 0e14b8839bf1cc749044a03d1cbc6966cac7291dd898e36f645a3e61cb73cdcc
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 0e14b8839bf1cc749044a03d1cbc6966cac7291dd898e36f645a3e61cb73cdcc
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
CloseHandle.KERNELBASE(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 024A003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 024A024D

Strings

kernel32.dll, xrefs: 024A008F, 024A0095
cess, xrefs: 024A018D

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 47db5edc071913791deb89cbc8230648d4aa3d877f6c379e8469fc357dd10e18
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3C526974A01229DFDB64CF58C994BADBBB1BF09304F1480DAE94DAB351DB30AA95CF14

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: ca0b5bb621994acda530d45d726ba1ad5c17bddbc5e981c8316112ba5a721b51
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: ca0b5bb621994acda530d45d726ba1ad5c17bddbc5e981c8316112ba5a721b51
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 024A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,024A0223,?,?), ref: 024A0E19
SetErrorMode.KERNELBASE(00000000,?,?,024A0223,?,?), ref: 024A0E1E

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 8cb0d109644ce714bdc84d03a3357bbc544987171c927014f260ece32c00e347
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 26D0123114512877DB002A94DC09BCE7B1CDF09B66F008011FB0DDD180C770954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 024ED068 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 024ED0B9

Memory Dump Source

Source File: 00000000.00000002.2105496878.00000000024DD000.00000040.00000020.00020000.00000000.sdmp, Offset: 024DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24dd000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 581e804555ee1f1edfc3e5f20f34d3a9f09f992aef3474c4cbfaa2fe4c582c21
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 2E113979A00208EFDB01DF98C985E99BBF5AF08751F1980A5F9489B361D771EA90DF80

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

wtm_c, xrefs: 0040C956
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
flags_upd, xrefs: 0040CE4A
\, xrefs: 0040D39D
.sys, xrefs: 0040D0CC
drivers\, xrefs: 0040D067
lid_file_upd, xrefs: 0040CE6A
wtm_r, xrefs: 0040C97F
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
srv_time, xrefs: 0040CABB
local_time, xrefs: 0040CACD
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
wtm_w, xrefs: 0040C96C
\, xrefs: 0040D3A7
4, xrefs: 0040D9F7
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
@, xrefs: 0040D754
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 46fa9df5c4306c0050bb7a85a3b5eefaefcafc26c9c293650c17aef5077f26c5
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 46fa9df5c4306c0050bb7a85a3b5eefaefcafc26c9c293650c17aef5077f26c5
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlSetLastWin32Error, xrefs: 004010D6
ntdll.dll, xrefs: 0040100D
NtSetInformationToken, xrefs: 00401175
NtQueryInformationToken, xrefs: 00401262
RtlFreeSid, xrefs: 00401116
NtTerminateProcess, xrefs: 004010F6
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtDuplicateToken, xrefs: 004011F3
RtlInitUnicodeString, xrefs: 00401135
NtOpenProcessToken, xrefs: 004011D4
NtSetInformationThread, xrefs: 00401155
RtlNtStatusToDosError, xrefs: 00401194
NtClose, xrefs: 004011B4
RtlLengthSid, xrefs: 00401246
NtFilterToken, xrefs: 0040122B

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Thu, xrefs: 0040B241
Dec, xrefs: 0040B2A3
Nov, xrefs: 0040B29C
Sat, xrefs: 0040B24F
Apr, xrefs: 0040B26B
Aug, xrefs: 0040B287
Fri, xrefs: 0040B248
Oct, xrefs: 0040B295
Jul, xrefs: 0040B280
Sun, xrefs: 0040B225
Jun, xrefs: 0040B279
Jan, xrefs: 0040B256
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
May, xrefs: 0040B272
Tue, xrefs: 0040B233
Mon, xrefs: 0040B22C
Sep, xrefs: 0040B28E
Wed, xrefs: 0040B23A
Feb, xrefs: 0040B25D
Mar, xrefs: 0040B264

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

<, xrefs: 00401378
@, xrefs: 00401380
D, xrefs: 004015C6
PDGu, xrefs: 0040139A
useless, xrefs: 0040161E
%systemroot%\system32\cmd.exe, xrefs: 00401316
wusa.exe, xrefs: 00401388
, xrefs: 00401462
uac, xrefs: 00401628

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: aad480b6e0e58a6918efc610d136f9871add2120a421913cbbbf5b4a59ea4240
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: aad480b6e0e58a6918efc610d136f9871add2120a421913cbbbf5b4a59ea4240
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

work_srv, xrefs: 00401E5E
net_type, xrefs: 00401E87
start_srv, xrefs: 00401E6C
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
born_date, xrefs: 00401EAD, 00401ECC
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
lid_file_upd, xrefs: 00401E25
kernel32, xrefs: 00401DF7
loader_id, xrefs: 00401F4B, 00401F6B
IsWow64Process, xrefs: 00401DF2
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 024A65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 024A65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 024A6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 024A6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 024A6652

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: cb1d8f5c56ce9c3b879c360ab8cb7279d7d45626068771758ccf8bbfa494f620
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: F1117771600218BFDB115F79DC55F9B3FACEB05BA5F154025FA04E7250D7B1DD408AA4

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: cfcaefece596f69424170c8c4d4841579e71e1bfc642e2c0992e76636a24e9ad
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: cfcaefece596f69424170c8c4d4841579e71e1bfc642e2c0992e76636a24e9ad
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 024A092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 024A09DC, 024A09DF, 024A09E4
l, xrefs: 024A0966
., xrefs: 024A095F

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 83b1f6a1e96997a5a0f1650ef269b331ccf1d5237051adc979373b0a2e30b189
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 733127B6900609DFEB10CF99C884BAEBBF9FF58324F15504AD841A7310D771EA45CBA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 024ECC86 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2105496878.00000000024DD000.00000040.00000020.00020000.00000000.sdmp, Offset: 024DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24dd000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: d48f909bb3a4a4f2dc5b6bf3a3e7823c8972401d9bc2e1953a6500aeae8acb8a
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 32118E72340100AFEB54DF59DCC1EA677EAEB88321B19806AED06CB311D676E842CB60

Function 024A0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: d2f4d3bb4b2cbe01b0d25eaf4a28ec74c27e07ab8f56957cf8c9ab6a2dcf7ba0
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: EB012673A106008FDF21CF20C914BAB33F5FB96206F0550BAD90AD7381E370A941CB80

Function 024A9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 024A9E6D
lstrcpy.KERNEL32(?,00000000), ref: 024A9FE1
lstrcat.KERNEL32(?,?), ref: 024A9FF2
lstrcat.KERNEL32(?,0041070C), ref: 024AA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 024AA054
DeleteFileA.KERNEL32(?), ref: 024AA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 024AA0D6
lstrcpy.KERNEL32 ref: 024AA12F
lstrlen.KERNEL32(00000022), ref: 024AA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 024A9F13

Part of subcall function 024A7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 024A7081

Part of subcall function 024A6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\ihgdldig,024A7043), ref: 024A6F4E
Part of subcall function 024A6F30: GetProcAddress.KERNEL32(00000000), ref: 024A6F55
Part of subcall function 024A6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 024A6F7B
Part of subcall function 024A6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 024A6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 024AA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 024AA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 024AA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 024AA21B
GetDriveTypeA.KERNEL32(?), ref: 024AA265
lstrcat.KERNEL32(?,00000000), ref: 024AA29F
lstrcat.KERNEL32(?,00410A34), ref: 024AA2C5
lstrcat.KERNEL32(?,00000022), ref: 024AA2D9
lstrcat.KERNEL32(?,00410A34), ref: 024AA2F4
wsprintfA.USER32 ref: 024AA31D
lstrcat.KERNEL32(?,00000000), ref: 024AA345
lstrcat.KERNEL32(?,?), ref: 024AA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 024AA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 024AA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 024AA1D1

Part of subcall function 024A9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 024A999D
Part of subcall function 024A9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 024A99BD
Part of subcall function 024A9966: RegCloseKey.ADVAPI32(?), ref: 024A99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 024AA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 024AA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 024AA41D

Strings

", xrefs: 024AA3F0
", xrefs: 024AA142
P, xrefs: 024AA011
\, xrefs: 024A9F73
D, xrefs: 024AA1F5
", xrefs: 024AA2DF

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 380615dd516ee1c4454639c524a757bf546e36cd55fe21a3e67eef2bcefaff17
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: EEF151B1C40259AFDF21DFA18C59FEF7BBCAB18304F4444AAE605E2141E7B58689CF64

Function 024A7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 024A7D21
GetUserNameA.ADVAPI32(?,?), ref: 024A7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024A7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 024A7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 024A7DC0
EqualSid.ADVAPI32(?,?), ref: 024A7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 024A7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024A7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 024A7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 024A7E12
LocalFree.KERNEL32(00000000), ref: 024A7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 024A7E35

Strings

PromptOnSecureDesktop, xrefs: 024A7FA0
D, xrefs: 024A7D73

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: d35ff5149e41532f3992582bacfff82785a5a6d9ca7b4c8d3f090fc4ae4fc1c5
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: CDA15C71900209AFDB218FA0DD98BEFBFB9FB18304F04816AF506E6250D7758A85CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

%d=%p, xrefs: 004066F9
12:08:32, xrefs: 00406535
va=%08X%08X uef=%p, xrefs: 00406595
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
Jan 13 2018, xrefs: 0040653A
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
except_info, xrefs: 00406728
localcfg, xrefs: 0040672D
plgs:, xrefs: 004066AA

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

helo %s, xrefs: 0040A803
Too big smtp respons (%d bytes), xrefs: 0040A9B1
Incorrect respons, xrefs: 0040AB39
data, xrefs: 0040A85E
mail from:<%s>, xrefs: 0040A848
AUTH LOGIN, xrefs: 0040A80C
Too small respons, xrefs: 0040A9C9
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
ehlo %s, xrefs: 0040A7F5
quit, xrefs: 0040A86C
rcpt to:<%s>, xrefs: 0040A855
., xrefs: 0040A8CA
ESMTP, xrefs: 0040AA38
localcfg, xrefs: 0040AB0B

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 59680a716c84fab098cc04c228647f95a811d0d2f75c561d0d852e03931200d7
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: 59680a716c84fab098cc04c228647f95a811d0d2f75c561d0d852e03931200d7
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 024A7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 024A7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024A7ACD
GetLengthSid.ADVAPI32(?), ref: 024A7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 024A7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 024A7B1F
EqualSid.ADVAPI32(?,?), ref: 024A7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 024A7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024A7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 024A7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 024A7B77
LocalFree.KERNEL32(00000000), ref: 024A7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 024A7B9A
GetAce.ADVAPI32(?,?,?), ref: 024A7BCA
EqualSid.ADVAPI32(?,?), ref: 024A7BF1
DeleteAce.ADVAPI32(?,?), ref: 024A7C0A
EqualSid.ADVAPI32(?,?), ref: 024A7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 024A7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024A7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 024A7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 024A7CE0
LocalFree.KERNEL32(00000000), ref: 024A7CEE

Strings

D, xrefs: 024A7AC3

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: eff90ccc0fa2f46189eec5eece767dc35345841f3761dba582bf97e237accd7f
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 0B814E71901219AFEB21CFA5DD94FEFBBB8AF18304F04807AE505E6250D7759641CBA4

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetAdaptersInfo, xrefs: 004019DC
Iphlpapi.dll, xrefs: 004019B7
GetBestInterface, xrefs: 004019EF
GetIfEntry, xrefs: 004019E4
123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 024A858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 024A865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 024A867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 024A86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 024A86B1

Strings

PromptOnSecureDesktop, xrefs: 024A85B6, 024A8645, 024A86BD, 024A8708, 024A87C5, 024A8812, 024A88E9, 024A8905
", xrefs: 024A896C

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: dcf0a04c7ba71f28f854aeefcd469f191568090f7039d88218456c2ae3593488
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: BDC1A1B1940208BEEB11EBA4DD95EEF7BBDEB24304F14407BF604E6150EBB14A948F65

Function 024A14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 024A1601
lstrlenW.KERNEL32(-00000003), ref: 024A17D8

Strings

, xrefs: 024A16C9
D, xrefs: 024A182D
<, xrefs: 024A15DF
@, xrefs: 024A15E7

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 1af3ef97217771ef43454e34bcb335c024a09d20611aaf443e0bccffb93b439a
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 27F17CB55083419FD720CF64C898BABB7E9FB98304F00892EF59A973A0D7B4D944CB56

Function 024A7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 024A76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 024A7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 024A778F
___ascii_stricmp.LIBCMT ref: 024A78B4
RegCloseKey.ADVAPI32(?), ref: 024A794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 024A796D
RegCloseKey.ADVAPI32(?), ref: 024A797E
RegCloseKey.ADVAPI32(?), ref: 024A79AC
RegCloseKey.ADVAPI32(?), ref: 024A7A56

Part of subcall function 024AF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,024A772A,?), ref: 024AF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 024A79F6
RegCloseKey.ADVAPI32(?), ref: 024A7A4D

Strings

PromptOnSecureDesktop, xrefs: 024A76C5, 024A76CA, 024A76E5, 024A7782, 024A77E6, 024A7862, 024A787B, 024A79C2
", xrefs: 024A7800

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 1ffffd282f3921c36e447d301ef497ad4b8365f68347931842ae0887c7d5e3bb
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 47C1A272900109BBEB219BA5DC54FEFBBBDEF68310F1040A7E504E6190EB719A84CF60

Function 024A2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 024A2CED
socket.WS2_32(00000002,00000002,00000011), ref: 024A2D07
htons.WS2_32(00000000), ref: 024A2D42
select.WS2_32 ref: 024A2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 024A2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 024A2E62

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 4c15de73a0143255bb13f0ba8300c4f3e80e0ce3663d3364fb54eeac172bc6e6
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: D861DE71504305ABC320DF61DC08BABBBE8FB68745F04481AFD8596290D7F5D8C0EBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

127.0.0.1, xrefs: 0040ADEB
%s%d, xrefs: 0040AE58
%OUTLOOK_MID, xrefs: 0040AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 024A958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 024A95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 024A95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 024A95DC
wsprintfA.USER32 ref: 024A9635
wsprintfA.USER32 ref: 024A9673
wsprintfA.USER32 ref: 024A96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 024A9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 024A978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 024A97D8

Strings

PromptOnSecureDesktop, xrefs: 024A9604, 024A9624, 024A9662, 024A9683, 024A96B6, 024A96DF, 024A9701, 024A9734, 024A9780, 024A97B7

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: d49333b511937cd5509594b47140042ba404196508b629281b8d12207ad6a767
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: FAA16CB2900608FBEB21DFA1CC95FDA3BADAB14741F10402BFA1596251E7B5D984CFA4

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

06A, xrefs: 0040BF70
46A, xrefs: 0040BF85
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C
86A, xrefs: 0040BF98

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: b0a2ae875f58e383b947a4d61bc12981f29674b2f93b28c56df9bb17aab017a1
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: b0a2ae875f58e383b947a4d61bc12981f29674b2f93b28c56df9bb17aab017a1
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%P5DATE, xrefs: 0040B4F2
%TO_HASH, xrefs: 0040B4B0
%M5DATE, xrefs: 0040B50F
%DATE, xrefs: 0040B4D2
%FROM_USER, xrefs: 0040B431
%s@%s, xrefs: 0040B461
%FROM_DOMAIN, xrefs: 0040B41E
%TO_EMAIL, xrefs: 0040B473
%TO_USER, xrefs: 0040B488
%TO_DOMAIN, xrefs: 0040B44B
%FROM_EMAIL, xrefs: 0040B3E9

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 024A1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 024A202D
GetSystemInfo.KERNEL32(?), ref: 024A204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 024A206A
GetProcAddress.KERNEL32(00000000), ref: 024A2071
GetCurrentProcess.KERNEL32(?), ref: 024A2082
GetTickCount.KERNEL32 ref: 024A2230

Part of subcall function 024A1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 024A1E7C

Strings

hi_id, xrefs: 024A217D, 024A2182, 024A219A
flags_upd, xrefs: 024A20A5, 024A20AA, 024A20E3
work_srv, xrefs: 024A20C5
localcfg, xrefs: 024A2091, 024A2098, 024A20AB, 024A20E4, 024A20F3, 024A2119, 024A2138, 024A214E, 024A2166, 024A2183, 024A219B, 024A21B7, 024A21D7

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 4c9cba2d561f697feac13ea6a8c87b74c877d4c8ea22612b02fb0070cdfb72f7
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 7E5109B06043446FE330AF768C95F67BAECEF64704F00492FF99686242D7B9A584CB65

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 024A3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 024A3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 024A3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 024A3095
RtlAllocateHeap.NTDLL(00000000), ref: 024A30B6
htons.WS2_32(00000035), ref: 024A30EF
inet_addr.WS2_32(?), ref: 024A30FA
gethostbyname.WS2_32(?), ref: 024A310D
HeapFree.KERNEL32(00000000), ref: 024A314D

Strings

iphlpapi.dll, xrefs: 024A3062, 024A3067, 024A3077

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 9c7b5df0936da859f79dbc212649e05ebee40c57e6b1faa0e304412478429acb
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: DC31C431A00606ABDB129FB89C58BAF7FB8EF14364F1441A7E518E7390EB74D5818B58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 024A6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 024A67C3
htonl.WS2_32(?), ref: 024A67DF
htonl.WS2_32(?), ref: 024A67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 024A68F1
ExitProcess.KERNEL32 ref: 024A69BC

Strings

except_info, xrefs: 024A698F
localcfg, xrefs: 024A6994

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitRead
String ID: except_info$localcfg
API String ID: 1430491713-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 9e5e8821f4d99644f09318874f49a71e9f045b8e30766a977a04da2e4e5c1a9e
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 4B615E71A40208AFDF609FB4DC45FEA77E9FB08300F14806AFA6DD2161EB7599948F54

Function 024AF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(024ACC84), ref: 024AF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 024AF5CE
closesocket.WS2_32(00000000), ref: 024AF5DC

Strings

time_cfg, xrefs: 024AF58A

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: b6aa57cad34af10768a56683d049e2ffd7dc972373438ad9cedb3d9a71e45cd4
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 2A318C72900118ABDB10DFA9DC88DEF7BBCEF98710F11456AF905E3150E7718A868BE4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: cea40b17ff8fa2f601ad1f23a222ab117a5c0c4b809ada7763c407b3c8c52c78
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: cea40b17ff8fa2f601ad1f23a222ab117a5c0c4b809ada7763c407b3c8c52c78
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 024A2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 024A2FA1
LoadLibraryA.KERNEL32(?), ref: 024A2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 024A2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 024A3000
RtlAllocateHeap.NTDLL(00000000), ref: 024A3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 024A3032

Strings

dnsapi.dll, xrefs: 024A2F90

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 08168c554423f5453186430667c27110308923e635c76b02fffe914f232ff4e3
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 48219271D00225BBCB219F55DC55AAFBFB8EF18B10F008462F902E7240E7B59AC19BD4

Function 024A6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\ihgdldig,024A7043), ref: 024A6F4E
GetProcAddress.KERNEL32(00000000), ref: 024A6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 024A6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 024A6F92

Strings

PromptOnSecureDesktop, xrefs: 024A6F9D, 024A6FBF, 024A6FCF, 024A6FE5, 024A6FF5
\\.\pipe\ihgdldig, xrefs: 024A6F37
C:\Windows\SysWOW64\, xrefs: 024A6F30, 024A6F38, 024A6F65, 024A6F6C, 024A6F7A, 024A6F85, 024A6F91, 024A6FA9, 024A6FC6, 024A6FEC

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\ihgdldig
API String ID: 1082366364-3344593279
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: f7c990e34da69f1ac399eebf1596b28a2c003a88ac9e3a9426fe3f0d3f495df1
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 242104217443407DF73253319CA9FFB2E4D8B72714F1D40AAF904D6680DBD984D686AD

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 024A92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 024A92E2
wsprintfA.USER32 ref: 024A9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 024A9375
lstrlen.KERNEL32(?,?,00000000), ref: 024A9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 024A9394
CloseHandle.KERNEL32(00000000), ref: 024A939B

Strings

PromptOnSecureDesktop, xrefs: 024A932B, 024A9343, 024A935E

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: d338e67af5ea1bd880f9eba8693bd893b178c2a2ab521d11c9ca42b69fa44e07
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 511184B57401147BE7206732EC0DFEF3A6EDBD8B10F00807ABB1AE5090EAB54A458A64

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 024A99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 024A9A18
GetThreadContext.KERNEL32(?,?), ref: 024A9A52
TerminateProcess.KERNEL32(?,00000000), ref: 024A9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 024A9A98
SetThreadContext.KERNEL32(?,00010002), ref: 024A9AB5
ResumeThread.KERNEL32(?), ref: 024A9AC2

Strings

D, xrefs: 024A9A10

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 41060c1d09c3c0dc54f45c02fae7c8f2e2011ea639d8e6d6aab9e042569cb718
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 2C213BB1A01219BBDF119BA1DC49EEF7BBCEF18750F404062BA19E5150E7758A84CBA4

Function 024A1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 024A1C18
LoadLibraryA.KERNEL32(004102C8), ref: 024A1C26
GetProcessHeap.KERNEL32 ref: 024A1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 024A1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 024A1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 024A1D02
FreeLibrary.KERNEL32(?), ref: 024A1D0B

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: f2a7a36ffce557fc8b99bc9da7dec8952ca7a1fee3e2a8f79f1d9d112d51ed94
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 16317832E00219BFCB119FA4DC989EFBAB9EB55301F24447AE509A7210D7B55E80DB94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: 430104cac5c13c71f5437c0750a91fe091c0dcfcbc33bae831f1428fc17f18ae
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: 430104cac5c13c71f5437c0750a91fe091c0dcfcbc33bae831f1428fc17f18ae
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 024A6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 024A6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 024A6D22
GetLastError.KERNEL32 ref: 024A6DA7
CloseHandle.KERNEL32(?), ref: 024A6DB5
GetLastError.KERNEL32 ref: 024A6DD6
DeleteFileA.KERNEL32(?), ref: 024A6DE7
GetLastError.KERNEL32 ref: 024A6DFD

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 5cdba45576c3063da9db8969e08a59dadef51548a73fb84c0794a86658713432
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: EA3110B2900249BFCF00DFA59D58ADF7F7DEB58340F09807AE211E3250D7708A818B61

Function 024A93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 024A93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 024A93CD
CharToOemA.USER32(?,?), ref: 024A93DB
wsprintfA.USER32 ref: 024A9410

Part of subcall function 024A92CB: GetTempPathA.KERNEL32(00000400,?), ref: 024A92E2
Part of subcall function 024A92CB: wsprintfA.USER32 ref: 024A9350
Part of subcall function 024A92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 024A9375
Part of subcall function 024A92CB: lstrlen.KERNEL32(?,?,00000000), ref: 024A9389
Part of subcall function 024A92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 024A9394
Part of subcall function 024A92CB: CloseHandle.KERNEL32(00000000), ref: 024A939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 024A9448

Strings

PromptOnSecureDesktop, xrefs: 024A93FA, 024A93FF, 024A941C

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 8495267e3d2081662291a5f7189bf1866bca42a5763bbdacd26f39c67f07971a
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 0F0152F69001187BD721A7619D89EDF377CDB95701F0040A6BB49E2080DAB497C58F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 024AAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 024AAAE5

Strings

localcfg, xrefs: 024AAD72
, xrefs: 024AABB3

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 99e1d28e9a5373cbeb2dccf07408ec960af6a59ffe56af0319b2267b60addfda
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 88713B71A04334AAEF318B54DCA5FEF377AAB30309F24402BF945A6190DF6689C8CB55

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: c9ad8023725aab8d2fa60d869e3a7a47c0dc8c499feb85b8788b54ce06fbb5cf
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: c9ad8023725aab8d2fa60d869e3a7a47c0dc8c499feb85b8788b54ce06fbb5cf
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 024AE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 024ADF6C: GetCurrentThreadId.KERNEL32 ref: 024ADFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 024AE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,024A6128), ref: 024AE950
lstrcmp.KERNEL32(?,00000008), ref: 024AE989

Strings

A, xrefs: 024AE960, 024AE965
A, xrefs: 024AE8C6, 024AE8CD, 024AE936, 024AE998
A, xrefs: 024AE9A0

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 467920a078492b973ececd3febc96d579cc16f82b2edb32562eda4b2efc9d283
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 18318C31B00705DBDB718F25C8A4BA77BE8FB25724F00893BE5A687651D370E881CB91

Function 024A6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 024A6E19

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 63e2d5e489377cba9357fb1877035bb17b1b8ca9673ce77f75d6e9b677061571
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 4621AF72204219FFDF10ABB1FC58EDF7FADEB48264B158426F502D1090EB70DA409A74

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 024AC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 024AC6B4
InterlockedIncrement.KERNEL32(024AC74B), ref: 024AC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,024AC747), ref: 024AC728
CloseHandle.KERNEL32(00000000,?,024AC747,00413588,024A8A77), ref: 024AC733

Strings

localcfg, xrefs: 024AC544

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 99e1659a4ddfbc2029d5c59fe13756adc7bba131c8e924c079d9d9b566bac4d5
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: A35139B1A00B418FD764CF2AC6E462ABBE9FB58704B50593FE18BC7A90D774E840CB50

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 024AE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,024AE50A,00000000,00000000,00000000,00020106,00000000,024AE50A,00000000,000000E4), ref: 024AE319
RegSetValueExA.ADVAPI32(024AE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 024AE38E
RegDeleteValueA.ADVAPI32(024AE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 024AE3BF
RegCloseKey.ADVAPI32(024AE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,024AE50A), ref: 024AE3C8

Strings

PromptOnSecureDesktop, xrefs: 024AE33A

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 1653e2d35e98b8cf082f643d091443124a6421caa29e2b2dc8b571c2df38af35
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 75214971A00219ABDB209FA5EC99EEF7F69EF18750F008076E914E6150E3B19A54DBA0

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 97717f860553cace0da6839a14b7da98954d63f37c5a4b4a783214777e1a839d
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 97717f860553cace0da6839a14b7da98954d63f37c5a4b4a783214777e1a839d
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 024A71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 024A71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024A7228
LocalFree.KERNEL32(?,?,?), ref: 024A7286
wsprintfA.USER32 ref: 024A729D

Strings

|, xrefs: 024A721A

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 619b2cbdded64ee6a572edc76710ccb4d8bdfe4398138226f0a164d769592991
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: E5313872A00208BBDB11DFA8DC55BDE7BACEF04314F14C066F859DB200EB79D6488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 024AB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 024AB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 024AB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 024AB548
GetTimeZoneInformation.KERNEL32(?), ref: 024AB590
wsprintfA.USER32 ref: 024AB61E

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 7d295969a6c5c57dee8efe6c9bb244c9e83db40bdf3797a1242d41e7769e76fe
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 9B510FB1D0021CAACF14DFD5D8985EEBBB9FF58308F10856BE505A6150E7B84AC9CF98

Function 024A62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 024A6303
LoadLibraryA.KERNEL32(?), ref: 024A632A
GetProcAddress.KERNEL32(00000000,?), ref: 024A63B1
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 024A6405

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 5cb588ddb60908532d0d28730bee9f48f03ea9190e61077b7c28401217012fd3
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 54415D71A00215EBDF14CF58C8A4BAAB7B8EF24358F19816AE925D7390D771E982CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79c3bb314f3d5ac5fee99c519c64317d163b7d5a05993d84b0a40af9e19cc60
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: c79c3bb314f3d5ac5fee99c519c64317d163b7d5a05993d84b0a40af9e19cc60
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 024AE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 024ADF6C: GetCurrentThreadId.KERNEL32 ref: 024ADFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,024AA6AC), ref: 024AE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,024AA6AC), ref: 024AE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,024AA6AC), ref: 024AE819

Strings

PromptOnSecureDesktop, xrefs: 024AE840, 024AE845, 024AE87C, 024AE89B

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: c8c60535d43afd0536240ee52782ab034bb8f42fcbbc6a21915f7c4b8793076c
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 552129B1A003007AF221B7329C56FEB3E0DDB75B60F50043EFA19B55D3EA9595508AB5

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 024A7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 024A76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 024A796D
RegCloseKey.ADVAPI32(?), ref: 024A797E

Strings

PromptOnSecureDesktop, xrefs: 024A76C5, 024A76CA, 024A76E5

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: c7d92763ff62da70b7dc043aec591530da6e4359ed87aa9cea3ee66e16d33d7c
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 5211B170A00109AFDB218FA9DC85FEFBF79EB65714F140156F515E6290E7B18950CB60

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 024A9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 024A999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 024A99BD
RegCloseKey.ADVAPI32(?), ref: 024A99C6

Strings

PromptOnSecureDesktop, xrefs: 024A9989, 024A998E, 024A99B0, 024A99D3

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 9266b8b5b856ce7591e89d9504094a2c536fb97c84874099d71cae95317e2a9c
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: E5F0F6B6680208BFF7116B51EC06FDB3A2DDBA4B10F500065FA05B5081F6E59B9096B9

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 024A28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 024A28FA
gethostbyname.WS2_32(u6A), ref: 024A2906

Strings

time_cfg, xrefs: 024A28EB
u6A, xrefs: 024A28EC, 024A28F9, 024A2905

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: a7d7c90861fc3a3fcd25f457fe540b690efc36afc8170fa38c2c81d3d67333d7
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 7AE012306055119FDB50DB2CF848AD677E5FF4A230F058696F855D72A0C7B4DCC1A754

Function 024A69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 024A69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 024A6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 024A6A3A
CloseHandle.KERNEL32(000000FF), ref: 024A6BD8

Part of subcall function 024AEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,024A1DCF,?), ref: 024AEEA8
Part of subcall function 024AEE95: HeapFree.KERNEL32(00000000), ref: 024AEEAF

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 595d16892dd2b2fbac38c69649fbf2038ed9d81c0e9a411627c4449407d93d2a
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 1771277190122DEFDF10DFA4CC90AEEBBB9FB08314F15456AE515A6290D7309E92DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 024A417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 024A41AB
GetLastError.KERNEL32 ref: 024A41B5
WaitForSingleObject.KERNEL32(?,?), ref: 024A41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 024A41D9

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 897dd8de4e9287ff1c02ca5458046d836bcd4624741343595ae66c9aec2e2813
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 5F010C7651110AAFDF02DF90ED89BEF7B6CEB18655F004462F901E2150DBB0DB548BB5

Function 024A41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 024A421F
GetLastError.KERNEL32 ref: 024A4229
WaitForSingleObject.KERNEL32(?,?), ref: 024A423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 024A424D

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 96b4e42ed606477c31172acca3bf9f581d7b7c55393d4c7fb22971e8b0bee827
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 0501C872511109AFDF11DF90EE84BEF7BACEB18395F108462F901E6150D7B0DA548BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 024AE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 024AE066

Strings

A, xrefs: 024AE07F
A, xrefs: 024AE036
A, xrefs: 024AE037, 024AE03C

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 859f4747887d7fa8bab7682d5c2a297de8be8c6550f54d66e61886575e06833e
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: E5F062713047229BCB20CF25D894A83B7E9FB19325B44863BE564C3260D374A4D9CF51

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 024AE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,024A44E2,00000000,00000000,00000000), ref: 024AE470
CloseHandle.KERNEL32(00000001,00000003), ref: 024AE484

Part of subcall function 024AE2FC: RegCreateKeyExA.ADVAPI32(80000001,024AE50A,00000000,00000000,00000000,00020106,00000000,024AE50A,00000000,000000E4), ref: 024AE319
Part of subcall function 024AE2FC: RegSetValueExA.ADVAPI32(024AE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 024AE38E
Part of subcall function 024AE2FC: RegDeleteValueA.ADVAPI32(024AE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 024AE3BF
Part of subcall function 024AE2FC: RegCloseKey.ADVAPI32(024AE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,024AE50A), ref: 024AE3C8

Strings

PromptOnSecureDesktop, xrefs: 024AE4F1, 024AE4F6, 024AE537, 024AE561

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 4d0b4c69fd86519acae76fe5a8a066781e19d7e7ae61465da24dc1d1e6378d21
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 7A410CB6E00204BAEB20AF928C55FDB3B6DDF24724F44803BFE1994191E3B58650DAB4

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 024A8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 024A83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 024A8477

Part of subcall function 024A69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 024A69E5
Part of subcall function 024A69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 024A6A26
Part of subcall function 024A69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 024A6A3A

Part of subcall function 024AEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,024A1DCF,?), ref: 024AEEA8
Part of subcall function 024AEE95: HeapFree.KERNEL32(00000000), ref: 024AEEAF

Strings

PromptOnSecureDesktop, xrefs: 024A83B2, 024A83B7, 024A8483

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 33f98a5c044544ea4c2bb1c8cfcc702b0bd9c456dc9a4c63009facac9d26b3a2
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 174161B2900109BFEB21EBA19D90EFF777DEB24344F1444BBE504E6110F7B15A948B64

Function 024AE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,024AE859,00000000,00020119,024AE859,PromptOnSecureDesktop), ref: 024AE64D
RegCloseKey.ADVAPI32(024AE859,?,?,?,?,000000C8,000000E4), ref: 024AE787

Strings

PromptOnSecureDesktop, xrefs: 024AE637

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: d68dfb6af512eab9a09438e2b1772a1330ae1acf8f098fe6c3e453b17ab2d0ba
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: B04129B6E0011DBFDF11EFA4DC90EEEBB79FB18304F144476EA10A6250E3719A558B60

Function 024AAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 024AAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 024AB00D

Part of subcall function 024AAF6F: gethostname.WS2_32(?,00000080), ref: 024AAF83
Part of subcall function 024AAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 024AAFE6

Part of subcall function 024A331C: gethostname.WS2_32(?,00000080), ref: 024A333F
Part of subcall function 024A331C: gethostbyname.WS2_32(?), ref: 024A3349

Part of subcall function 024AAA0A: inet_ntoa.WS2_32(00000000), ref: 024AAA10

Strings

%OUTLOOK_BND_, xrefs: 024AB076, 024AB07B, 024AB0BE, 024AB0DD

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: c86b3f7b43f7f9117b9586f87de5b947840018ea39af6ca6160a37a3387911e4
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 6D418F7290420CABDB21EFA1DC45EEE3BADFF18304F14442BFA2592151EA75DA84CF54

Function 024A9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 024A9536
Sleep.KERNEL32(000001F4), ref: 024A955D

Strings

, xrefs: 024A94D9

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: d83862207f05f2b87badda3cce4fef677f246363d92b7ce9ae846424a462943f
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: BE4127B28083947FFB368B68D8BE7A73FA59B22314F1800A7D08297292D7B44981C711

Function 024ABC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 024AB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 024ABA3A
InterlockedIncrement.KERNEL32(?), ref: 024ABA94
GetTickCount.KERNEL32 ref: 024ABB79
GetTickCount.KERNEL32 ref: 024ABB99
InterlockedIncrement.KERNEL32(?), ref: 024ABE15
closesocket.WS2_32(00000000), ref: 024ABEB4

Strings

%FROM_EMAIL, xrefs: 024ABC7D

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 4634ee89bbf5349b292d425c3c2457c21bacd6eb13b51563dab9a3c683ab5067
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 71317C71500248DFDF25DFA5DCA4AEAB7B9EB68704F20405BFA2592160DB35DA85CF10

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 024A709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 024A70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 024A70F4

Strings

|, xrefs: 024A70E6

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: dd6d1424262e60bb28c0e6f0fe6234be747920d498fda65566febece19ad9aa7
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 8011FA72900118EBDB22CBD4DC84ADFB7FDAB04715F1441B6E601EA294D7749B88CBA4

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 024A3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 024A2F88: GetModuleHandleA.KERNEL32(?), ref: 024A2FA1
Part of subcall function 024A2F88: LoadLibraryA.KERNEL32(?), ref: 024A2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 024A31DA
HeapFree.KERNEL32(00000000), ref: 024A31E1

Memory Dump Source

Source File: 00000000.00000002.2105352533.00000000024A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24a0000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 21fa0731ce8447611422fe65e65a4de6535e0f71cd0a3ce068d7dd26508215db
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 6051BD3190424AAFCF019F64D894AFABB75FF25304B1445AAEC9697210F7729A19CB90

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.2103604609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2103604609.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_H3nfKrgQbi.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 62cf705a705524b5481c3e56b905c2216abe02b2d19e69cd26a80eb50737c7aa
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 62cf705a705524b5481c3e56b905c2216abe02b2d19e69cd26a80eb50737c7aa
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: wuefhdgm.exePID: 5864, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	30.5%
Signature Coverage:	0%
Total number of Nodes:	1577
Total number of Limit Nodes:	13

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\H3nfKrgQbi.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 0040A189
P, xrefs: 00409DAA
%X%08X, xrefs: 0040A0B0
\, xrefs: 00409D0C
C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 0040A1D9
C:\Users\user\Desktop\H3nfKrgQbi.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
D, xrefs: 00409F8E
", xrefs: 0040A078
", xrefs: 00409EDB
bazwewbz, xrefs: 0040A389, 0040A397

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\H3nfKrgQbi.exe$C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe$D$P$\$bazwewbz
API String ID: 2089075347-2696082175
Opcode ID: b647bd1953702a4e8b088f3dc0f7098de6aafb44af3c1151fcc255aea30f3bc8
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: b647bd1953702a4e8b088f3dc0f7098de6aafb44af3c1151fcc255aea30f3bc8
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: cfcaefece596f69424170c8c4d4841579e71e1bfc642e2c0992e76636a24e9ad
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: cfcaefece596f69424170c8c4d4841579e71e1bfc642e2c0992e76636a24e9ad
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 0e14b8839bf1cc749044a03d1cbc6966cac7291dd898e36f645a3e61cb73cdcc
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 0e14b8839bf1cc749044a03d1cbc6966cac7291dd898e36f645a3e61cb73cdcc
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 024F003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 024F024D

Strings

cess, xrefs: 024F018D
kernel32.dll, xrefs: 024F008F, 024F0095

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: fbf06393b412c87a3d50d88f0dbf1f48102c0f1d04f45ddb18649da5986a0ba6
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3E526D74A01229DFDBA4CF58C984BADBBB1BF49304F1480DAE54DA7356DB30AA85CF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 02538031 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02538059
Module32First.KERNEL32(00000000,00000224), ref: 02538079

Memory Dump Source

Source File: 0000000C.00000002.2105550467.0000000002528000.00000040.00000020.00020000.00000000.sdmp, Offset: 02528000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2528000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 51012cf4f23a6d081ef99955388ea8be7b873c06eddd7618440f45bdfb026f51
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 75F06235500715ABD7252AF9A88CB7A77ECBF49624F101628F642D10C0DB74E8454A65

Function 024F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,024F0223,?,?), ref: 024F0E19
SetErrorMode.KERNELBASE(00000000,?,?,024F0223,?,?), ref: 024F0E1E

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a1355340812a76edfb87e8f37077e87cd166259ba3829630d5b4c7a92252a5d3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 52D01231545128B7D7402A94DC09BCE7B1CDF45B66F008011FB0DD9181C770954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 02537CF0 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02537D41

Memory Dump Source

Source File: 0000000C.00000002.2105550467.0000000002528000.00000040.00000020.00020000.00000000.sdmp, Offset: 02528000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2528000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9eeb3f5a463af17f9ae3b4054fa24c27836664612d13a420b9df645b9077d138
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: BF112B79A00208EFDB01DF98C985E98BBF5AF08351F058094F9489B361D371EA50DF84

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 024F65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 024F65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 024F6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 024F6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 024F6652

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 27cab6013b85eb5c5bffe58820841bee06a415e93b3e3a7b3b3167204318af1b
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: B511A771600218BFEB515F65DC05F9B3FACEB44BA5F014025FA14E7250D7B1DD008AA4

Function 024F9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 024F9E6D
lstrcpy.KERNEL32(?,00000000), ref: 024F9FE1
lstrcat.KERNEL32(?,?), ref: 024F9FF2
lstrcat.KERNEL32(?,0041070C), ref: 024FA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 024FA054
DeleteFileA.KERNEL32(?), ref: 024FA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 024FA0D6
lstrcpy.KERNEL32 ref: 024FA12F
lstrlen.KERNEL32(00000022), ref: 024FA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 024F9F13

Part of subcall function 024F7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 024F7081

Part of subcall function 024F6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\ihgdldig,024F7043), ref: 024F6F4E
Part of subcall function 024F6F30: GetProcAddress.KERNEL32(00000000), ref: 024F6F55
Part of subcall function 024F6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 024F6F7B
Part of subcall function 024F6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 024F6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 024FA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 024FA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 024FA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 024FA21B
GetDriveTypeA.KERNEL32(?), ref: 024FA265
lstrcat.KERNEL32(?,00000000), ref: 024FA29F
lstrcat.KERNEL32(?,00410A34), ref: 024FA2C5
lstrcat.KERNEL32(?,00000022), ref: 024FA2D9
lstrcat.KERNEL32(?,00410A34), ref: 024FA2F4
wsprintfA.USER32 ref: 024FA31D
lstrcat.KERNEL32(?,00000000), ref: 024FA345
lstrcat.KERNEL32(?,?), ref: 024FA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 024FA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 024FA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 024FA1D1

Part of subcall function 024F9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 024F999D
Part of subcall function 024F9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 024F99BD
Part of subcall function 024F9966: RegCloseKey.ADVAPI32(?), ref: 024F99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 024FA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 024FA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 024FA41D

Strings

D, xrefs: 024FA1F5
", xrefs: 024FA142
", xrefs: 024FA3F0
", xrefs: 024FA2DF
\, xrefs: 024F9F73
P, xrefs: 024FA011

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: bf7d0c391061cdff028913eb27c40a402faff4eed16d80f8600fcca9b42e50ca
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 9EF153B1D40259AFDF61DBA0DC48FEF7BBCAB48304F0440AAE709E2141E7B586858F65

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlInitUnicodeString, xrefs: 00401135
RtlNtStatusToDosError, xrefs: 00401194
NtTerminateProcess, xrefs: 004010F6
RtlFreeSid, xrefs: 00401116
NtClose, xrefs: 004011B4
RtlAllocateAndInitializeSid, xrefs: 0040120F
ntdll.dll, xrefs: 0040100D
NtSetInformationThread, xrefs: 00401155
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtSetInformationToken, xrefs: 00401175
NtFilterToken, xrefs: 0040122B
NtOpenProcessToken, xrefs: 004011D4
RtlSetLastWin32Error, xrefs: 004010D6
RtlLengthSid, xrefs: 00401246
NtQueryInformationToken, xrefs: 00401262
NtDuplicateToken, xrefs: 004011F3

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

May, xrefs: 0040B272
Apr, xrefs: 0040B26B
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Jul, xrefs: 0040B280
Oct, xrefs: 0040B295
Wed, xrefs: 0040B23A
Mar, xrefs: 0040B264
Nov, xrefs: 0040B29C
Jun, xrefs: 0040B279
Fri, xrefs: 0040B248
Dec, xrefs: 0040B2A3
Tue, xrefs: 0040B233
Sun, xrefs: 0040B225
Jan, xrefs: 0040B256
Aug, xrefs: 0040B287
Sat, xrefs: 0040B24F
Mon, xrefs: 0040B22C
Thu, xrefs: 0040B241
Sep, xrefs: 0040B28E
Feb, xrefs: 0040B25D

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24
D, xrefs: 00407B0C

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe$D
API String ID: 2976863881-489978695
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 024F7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 024F7D21
GetUserNameA.ADVAPI32(?,?), ref: 024F7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024F7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 024F7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 024F7DC0
EqualSid.ADVAPI32(?,?), ref: 024F7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 024F7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024F7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 024F7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 024F7E12
LocalFree.KERNEL32(00000000), ref: 024F7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 024F7E35

Strings

D, xrefs: 024F7D73
C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 024F7F49, 024F7F76, 024F7F8A, 024F7F8B

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe$D
API String ID: 2976863881-489978695
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 1441937d74dc65ba5814485312ffec28e4fbc7986d073e480e555acb78138403
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 82A16E71900209AFDB518FA0DD88FEFBFB9FB48304F04816AE605E6250E7758A85CB64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

12:08:32, xrefs: 00406535
va=%08X%08X uef=%p, xrefs: 00406595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
%d=%p, xrefs: 004066F9
except_info, xrefs: 00406728
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
localcfg, xrefs: 0040672D
Jan 13 2018, xrefs: 0040653A
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
plgs:, xrefs: 004066AA

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
ehlo %s, xrefs: 0040A7F5
Too small respons, xrefs: 0040A9C9
Incorrect respons, xrefs: 0040AB39
helo %s, xrefs: 0040A803
data, xrefs: 0040A85E
mail from:<%s>, xrefs: 0040A848
rcpt to:<%s>, xrefs: 0040A855
ESMTP, xrefs: 0040AA38
AUTH LOGIN, xrefs: 0040A80C
Too big smtp respons (%d bytes), xrefs: 0040A9B1
quit, xrefs: 0040A86C
localcfg, xrefs: 0040AB0B
., xrefs: 0040A8CA

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 59680a716c84fab098cc04c228647f95a811d0d2f75c561d0d852e03931200d7
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: 59680a716c84fab098cc04c228647f95a811d0d2f75c561d0d852e03931200d7
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 024F7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 024F7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024F7ACD
GetLengthSid.ADVAPI32(?), ref: 024F7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 024F7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 024F7B1F
EqualSid.ADVAPI32(?,?), ref: 024F7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 024F7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024F7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 024F7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 024F7B77
LocalFree.KERNEL32(00000000), ref: 024F7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 024F7B9A
GetAce.ADVAPI32(?,?,?), ref: 024F7BCA
EqualSid.ADVAPI32(?,?), ref: 024F7BF1
DeleteAce.ADVAPI32(?,?), ref: 024F7C0A
EqualSid.ADVAPI32(?,?), ref: 024F7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 024F7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 024F7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 024F7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 024F7CE0
LocalFree.KERNEL32(00000000), ref: 024F7CEE

Strings

D, xrefs: 024F7AC3

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 55367e2dc6caccfa52f05685572d25ec9026ae9b0629e6e6dd61d30a39351a76
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: B8815D71900259AFEB51CFA4DD84FEFBBB8EF48304F04806AE605E6250D7798681CB64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe$localcfg
API String ID: 237177642-767073137
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
, xrefs: 00401462
D, xrefs: 004015C6
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316
uac, xrefs: 00401628
useless, xrefs: 0040161E
PDGu, xrefs: 0040139A
<, xrefs: 00401378

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: aad480b6e0e58a6918efc610d136f9871add2120a421913cbbbf5b4a59ea4240
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: aad480b6e0e58a6918efc610d136f9871add2120a421913cbbbf5b4a59ea4240
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

start_srv, xrefs: 00401E6C
work_srv, xrefs: 00401E5E
net_type, xrefs: 00401E87
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
kernel32, xrefs: 00401DF7
lid_file_upd, xrefs: 00401E25
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
loader_id, xrefs: 00401F4B, 00401F6B
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
born_date, xrefs: 00401EAD, 00401ECC
IsWow64Process, xrefs: 00401DF2

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetAdaptersInfo, xrefs: 004019DC
GetIfEntry, xrefs: 004019E4
Iphlpapi.dll, xrefs: 004019B7
123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 024F858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 024F865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 024F867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 024F86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 024F86B1

Strings

", xrefs: 024F896C
C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 024F882F, 024F883C, 024F884C

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe
API String ID: 237177642-2235305659
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: f3aa70a5eba402f650266a0e1d6d9f756bb6284a8b419a97865b093a981d91bc
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: D2C191B2900149BFEB51ABA4DD84EEF7BBDEB84304F14406BF704EA150E7B04A948F65

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 024F14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 024F1601
lstrlenW.KERNEL32(-00000003), ref: 024F17D8

Strings

<, xrefs: 024F15DF
@, xrefs: 024F15E7
, xrefs: 024F16C9
D, xrefs: 024F182D

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: f4d1a6300ba202540b5e8f883527a1f752ef79c049d4e5137a6afa3d06c12475
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 1AF138B1508341DFD720DF64C888AABB7E5FBC8305F00892EFA9997390D7B49944CB66

Function 024F7666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 024F76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 024F7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 024F778F
___ascii_stricmp.LIBCMT ref: 024F78B4
RegCloseKey.ADVAPI32(?), ref: 024F794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 024F796D
RegCloseKey.ADVAPI32(?), ref: 024F797E
RegCloseKey.ADVAPI32(?), ref: 024F79AC
RegCloseKey.ADVAPI32(?), ref: 024F7A56

Part of subcall function 024FF40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,024F772A,?), ref: 024FF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 024F79F6
RegCloseKey.ADVAPI32(?), ref: 024F7A4D

Strings

", xrefs: 024F7800

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 81ad110082cff91c28e047ef74f734b7936b3517d77cf77b3a800cf6e4774b84
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: F3C18571900209AFEB51DBA5DC44FEFBBB9EF89710F1140A7E604E6190EB759A84CF60

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 024F2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 024F2CED
socket.WS2_32(00000002,00000002,00000011), ref: 024F2D07
htons.WS2_32(00000000), ref: 024F2D42
select.WS2_32 ref: 024F2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 024F2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 024F2E62

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 8d26452d8de5cee50ac0cb9b522a8e7fb290aa63a477adde45208256b8fb0e06
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 6461DF71904305ABC360DF61DC08B6BBBE8FB88745F15481AFE8597250E7F5D881CBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_MID, xrefs: 0040AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_HST, xrefs: 0040AEC5
127.0.0.1, xrefs: 0040ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%s%d, xrefs: 0040AE58

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_HASH, xrefs: 0040B4B0
%FROM_USER, xrefs: 0040B431
%P5DATE, xrefs: 0040B4F2
%FROM_EMAIL, xrefs: 0040B3E9
%M5DATE, xrefs: 0040B50F
%s@%s, xrefs: 0040B461
%TO_DOMAIN, xrefs: 0040B44B
%TO_EMAIL, xrefs: 0040B473
%FROM_DOMAIN, xrefs: 0040B41E
%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 024F1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 024F202D
GetSystemInfo.KERNEL32(?), ref: 024F204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 024F206A
GetProcAddress.KERNEL32(00000000), ref: 024F2071
GetCurrentProcess.KERNEL32(?), ref: 024F2082
GetTickCount.KERNEL32 ref: 024F2230

Part of subcall function 024F1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 024F1E7C

Strings

localcfg, xrefs: 024F2091, 024F2098, 024F20AB, 024F20E4, 024F20F3, 024F2119, 024F2138, 024F214E, 024F2166, 024F2183, 024F219B, 024F21B7, 024F21D7
flags_upd, xrefs: 024F20A5, 024F20AA, 024F20E3
work_srv, xrefs: 024F20C5
hi_id, xrefs: 024F217D, 024F2182, 024F219A

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: ce329c1d40c6f2450a756dbdc994d81b02cc0cd1ad1b5a25742d8a2d7c7d6bbd
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: C651D870900344AFE370AF768C85F677AECEB84704F00491FFB9686252D7B5A584CB65

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_ip, xrefs: 0040218F

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 024F3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 024F3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 024F3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 024F3095
RtlAllocateHeap.NTDLL(00000000), ref: 024F30B6
htons.WS2_32(00000035), ref: 024F30EF
inet_addr.WS2_32(?), ref: 024F30FA
gethostbyname.WS2_32(?), ref: 024F310D
HeapFree.KERNEL32(00000000), ref: 024F314D

Strings

iphlpapi.dll, xrefs: 024F3062, 024F3067, 024F3077

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: b5941bdf0e5a18d3ca32d5ad44bfc31c8debd8c0750dd4b3e60d2b76f2e39b52
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 5231C731A00246ABDB929FB49D48BAF7F78EF44364F1441A7E618E3390DB74D541CB58

Function 024F958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 024F95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 024F95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 024F95DC
wsprintfA.USER32 ref: 024F9635
wsprintfA.USER32 ref: 024F9673
wsprintfA.USER32 ref: 024F96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 024F9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 024F978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 024F97D8

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: c62da10363847511f7d41fb28b29905a10d214479ad9571535335d696d760b4f
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: E2A16AB2900608FBEB61DFA1CC45FDB3BADAB84740F10402BFA1596251E7B5D584CFA5

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: b0a2ae875f58e383b947a4d61bc12981f29674b2f93b28c56df9bb17aab017a1
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: b0a2ae875f58e383b947a4d61bc12981f29674b2f93b28c56df9bb17aab017a1
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 024F6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 024F67C3
htonl.WS2_32(?), ref: 024F67DF
htonl.WS2_32(?), ref: 024F67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 024F68F1
ExitProcess.KERNEL32 ref: 024F69BC

Strings

localcfg, xrefs: 024F6994
except_info, xrefs: 024F698F

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitRead
String ID: except_info$localcfg
API String ID: 1430491713-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 0e70a0c211c851caf44840e893623a4cec965050d5488d61d3f5b052dbc368d2
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: E4616E71A40208AFDB609FB4DC45FEA77E9FB48300F14806AFA6DD2161EB7599908F14

Function 024FF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(024FCC84), ref: 024FF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 024FF5CE
closesocket.WS2_32(00000000), ref: 024FF5DC

Strings

time_cfg, xrefs: 024FF58A

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: a829de05e2eba03b54815dd0ff9ee2fe8db07ce13d9aef3e8d33ae16f26a9663
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: E3316071900118ABDB50DFA5DC84DEF7BBCEF88710F11456AFA15D3190E7709A86CBA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: cea40b17ff8fa2f601ad1f23a222ab117a5c0c4b809ada7763c407b3c8c52c78
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: cea40b17ff8fa2f601ad1f23a222ab117a5c0c4b809ada7763c407b3c8c52c78
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 024F2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 024F2FA1
LoadLibraryA.KERNEL32(?), ref: 024F2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 024F2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 024F3000
RtlAllocateHeap.NTDLL(00000000), ref: 024F3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 024F3032

Strings

dnsapi.dll, xrefs: 024F2F90

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 2c59d0c05404c5f111d6e5b042553de91452c6174e488aef36d94586a3a6b15f
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 8F219271D40226BBCB619F55DC44AAFBFB8EF48B10F014462FA01E7640D7B49AC18BE4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 024F99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 024F9A18
GetThreadContext.KERNEL32(?,?), ref: 024F9A52
TerminateProcess.KERNEL32(?,00000000), ref: 024F9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 024F9A98
SetThreadContext.KERNEL32(?,00010002), ref: 024F9AB5
ResumeThread.KERNEL32(?), ref: 024F9AC2

Strings

D, xrefs: 024F9A10

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: f7f3f54aa703419f78af6d8174274fff446d7e0cc361af7e5f57a851cc2c0ba7
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 60213BB1E01229BBDB619BA1DC09FEF7BBCEF44750F404062BA19E1150E7758A84CBA4

Function 024F1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 024F1C18
LoadLibraryA.KERNEL32(004102C8), ref: 024F1C26
GetProcessHeap.KERNEL32 ref: 024F1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 024F1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 024F1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 024F1D02
FreeLibrary.KERNEL32(?), ref: 024F1D0B

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 58d04e133c32add87a4f6a944e0ec9dcd761273cee871b8b98abb98e1666041a
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: D3315E32D00249FFCB519FA4DC888AFBAB9EB85705B24447BE609A2210D7B55E80DB94

Function 024F6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 024F6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 024F6D22
GetLastError.KERNEL32 ref: 024F6DA7
CloseHandle.KERNEL32(?), ref: 024F6DB5
GetLastError.KERNEL32 ref: 024F6DD6
DeleteFileA.KERNEL32(?), ref: 024F6DE7
GetLastError.KERNEL32 ref: 024F6DFD

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 46d94ca98cbaa321f52e1f5e2f7c8e1286a166fefbeaa3efd10aa1a04272255d
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: E431EE73900249BFCB419FA59D48ADF7F7DEB88300F16816AE321A3220D7708A858B61

Function 024F6F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\ihgdldig,024F7043), ref: 024F6F4E
GetProcAddress.KERNEL32(00000000), ref: 024F6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 024F6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 024F6F92

Strings

C:\Windows\SysWOW64\, xrefs: 024F6F30, 024F6F38, 024F6F65, 024F6F6C, 024F6F7A, 024F6F85, 024F6F91, 024F6FA9, 024F6FC6, 024F6FEC
\\.\pipe\ihgdldig, xrefs: 024F6F37

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\ihgdldig
API String ID: 1082366364-4262714149
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 0fa34587edd491e716f7d1618f33a3e59758859a38f8c42be2438947ca87c465
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: B421F2217403403EF7A257319C88FBB2A4C8F92714F1A40AAFA0495AD0DBD984DA8A7D

Function 024FAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 024FAAE5

Strings

localcfg, xrefs: 024FAD72
, xrefs: 024FABB3

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 1bce074a5de0d44bb125ee1f6e55e93cf9469f5f2bfa0e6d82615cb31421aafb
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 5A712B72A00364ABDFA19B54DC85FEF376AABC0749F244027FB0CA61D0DF6199C88B55

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: c9ad8023725aab8d2fa60d869e3a7a47c0dc8c499feb85b8788b54ce06fbb5cf
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: c9ad8023725aab8d2fa60d869e3a7a47c0dc8c499feb85b8788b54ce06fbb5cf
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 024FE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 024FDF6C: GetCurrentThreadId.KERNEL32 ref: 024FDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 024FE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,024F6128), ref: 024FE950
lstrcmp.KERNEL32(?,00000008), ref: 024FE989

Strings

A, xrefs: 024FE960, 024FE965
A, xrefs: 024FE9A0
A, xrefs: 024FE8C6, 024FE8CD, 024FE936, 024FE998

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: dadaf5de2ed26876fb454433dc0f7590e0106b56fee411f013dd345338b3e8bb
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: A1319231B00705DBDBB18F25C884FAB7BE5EB85726F00852BEB5587661D370E480CBA1

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 024F6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 024F6E19

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 30ab593c2473aebfd1d45b0ea47de3bac8974f8690fb089cbf03723c8bf40b88
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 04215C73204219BFDB509BB1FC48EDF7FADEB89265B118426F612D10A0FB71DA409A74

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 024F92CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 024F92E2
wsprintfA.USER32 ref: 024F9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 024F9375
lstrlen.KERNEL32(?,?,00000000), ref: 024F9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 024F9394
CloseHandle.KERNEL32(00000000), ref: 024F939B

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 00e0c5956023fe4b07fbb779d4e377da03230f15907cf86a314cb9cc18d752be
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: EE119AB57401147BE7606732DC0DFEF3A6EDFC8B11F01C06ABB06E5090EAB44A458A75

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 024FC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 024FC6B4
InterlockedIncrement.KERNEL32(024FC74B), ref: 024FC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,024FC747), ref: 024FC728
CloseHandle.KERNEL32(00000000,?,024FC747,00413588,024F8A77), ref: 024FC733

Strings

localcfg, xrefs: 024FC544

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: d800eaceae510e1df57b912a0c9065c9211c0c13b61362d09497bacd5537fa87
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 97514CB1A04B458FD7A4CF29C5C462ABBE9FB88704B50693FE28BC7A90D774E444CB50

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe
API String ID: 124786226-3712348508
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 024F71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 024F71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 024F7228
LocalFree.KERNEL32(?,?,?), ref: 024F7286
wsprintfA.USER32 ref: 024F729D

Strings

|, xrefs: 024F721A

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 37e515816f8ccd3fd5b0a66c7130925b7837e47e00d98b9a33afabb3d3c56606
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 9D313872A00208BFDB41DFA8DC44BDB7BACEF44314F148066F959DB240EB79D6488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 430104cac5c13c71f5437c0750a91fe091c0dcfcbc33bae831f1428fc17f18ae
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: 430104cac5c13c71f5437c0750a91fe091c0dcfcbc33bae831f1428fc17f18ae
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 024FB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 024FB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 024FB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 024FB548
GetTimeZoneInformation.KERNEL32(?), ref: 024FB590
wsprintfA.USER32 ref: 024FB61E

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 7c1e5bd8289b24d1cd9650f3b7a713fa30cfff52a6da8684ce552db02d8485b7
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 375111B1D0021DAACF54DFD5D8445EEBBB9FF49308F10816BE605A6150E7B84AC9CF98

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 024F62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 024F6303
LoadLibraryA.KERNEL32(?), ref: 024F632A
GetProcAddress.KERNEL32(00000000,?), ref: 024F63B1
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 024F6405

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 4fd8eb62b7d13b9e75f98712db089c9eef1ded8d6fcc7d0094217f2e82e0c335
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 48417E71A00219AFDB54CF58C884BAAB7B8EF84318F16816EEA25D7390E771E941CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79c3bb314f3d5ac5fee99c519c64317d163b7d5a05993d84b0a40af9e19cc60
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: c79c3bb314f3d5ac5fee99c519c64317d163b7d5a05993d84b0a40af9e19cc60
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 024F93AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 024F93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 024F93CD
CharToOemA.USER32(?,?), ref: 024F93DB
wsprintfA.USER32 ref: 024F9410

Part of subcall function 024F92CB: GetTempPathA.KERNEL32(00000400,?), ref: 024F92E2
Part of subcall function 024F92CB: wsprintfA.USER32 ref: 024F9350
Part of subcall function 024F92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 024F9375
Part of subcall function 024F92CB: lstrlen.KERNEL32(?,?,00000000), ref: 024F9389
Part of subcall function 024F92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 024F9394
Part of subcall function 024F92CB: CloseHandle.KERNEL32(00000000), ref: 024F939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 024F9448

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 7aa64262734e9c28a7cde013a6e2a3c02bd3f6b9aa9b44ac7b0a71dbe2d4fabe
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: A4015EF69001187BDB61A7619D89FDF3B7CDBD5701F0040A6BB49E2080EAB496C98F75

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 024F28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 024F28FA
gethostbyname.WS2_32(u6A), ref: 024F2906

Strings

u6A, xrefs: 024F28EC, 024F28F9, 024F2905
time_cfg, xrefs: 024F28EB

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 04a30915f72c89a7130f78be1c237eb8441b54fff2797699d3e31540da7430e3
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 97E0C2306041118FCB80CB2CF848AC637E4EF8A230F008282F940D32A0C7B4DCC09740

Function 024F69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 024F69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 024F6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 024F6A3A
CloseHandle.KERNEL32(000000FF), ref: 024F6BD8

Part of subcall function 024FEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,024F1DCF,?), ref: 024FEEA8
Part of subcall function 024FEE95: HeapFree.KERNEL32(00000000), ref: 024FEEAF

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 938147c7c0cc6e4ac267dfe4d3b18324f6311335e6d7007dcd3517a4f118d760
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 9F712971D0022DEFDF11DFA4CD80AEEBBB9FB44314F11456AE625A6290D7309E92CB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 97717f860553cace0da6839a14b7da98954d63f37c5a4b4a783214777e1a839d
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 97717f860553cace0da6839a14b7da98954d63f37c5a4b4a783214777e1a839d
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 024FE2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,024FE50A,00000000,00000000,00000000,00020106,00000000,024FE50A,00000000,000000E4), ref: 024FE319
RegSetValueExA.ADVAPI32(024FE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 024FE38E
RegDeleteValueA.ADVAPI32(024FE50A,?,?,?,?,?,000000C8,004122F8), ref: 024FE3BF
RegCloseKey.ADVAPI32(024FE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,024FE50A), ref: 024FE3C8

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 961e00fdc4dfd9beae16d4dcc7fc12e15c1089d0304f5a021ebde7572bae9d7d
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 3A214F71A0021DABDF609FA5EC89EDF7F79EF48750F048026FA04E6160E3B19A54DB91

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 024F417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 024F41AB
GetLastError.KERNEL32 ref: 024F41B5
WaitForSingleObject.KERNEL32(?,?), ref: 024F41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 024F41D9

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: e25839bc1c0ccd4d78a83f97f8c62893c935e49a87f215d732c3eda93b177f8d
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B701E97651110EABDF02DF90EE88BEF7B6CEB18255F004062FA01E2150DB70AB548BB5

Function 024F41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 024F421F
GetLastError.KERNEL32 ref: 024F4229
WaitForSingleObject.KERNEL32(?,?), ref: 024F423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 024F424D

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: f81c76ef026897eaab91a6c462a0c3af0e84f051b9661b6027abee0e54737243
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 1A010872511109AFDF41DF90ED84BEF7BACEB48295F018062FA01E6150DB70DA548BB6

Function 024FE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 024FE066

Strings

A, xrefs: 024FE036
A, xrefs: 024FE07F
A, xrefs: 024FE037, 024FE03C

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 5e63c1852aae49fa7618872449b59412900e7ec915620f9e5e5c56066fc0d285
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 04F062313007229FCB60CF25D884A83B7E9FB85326B54872BE654C3A70D374A499CF55

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 024F8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 024F83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 024F8477

Part of subcall function 024F69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 024F69E5
Part of subcall function 024F69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 024F6A26
Part of subcall function 024F69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 024F6A3A

Part of subcall function 024FEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,024F1DCF,?), ref: 024FEEA8
Part of subcall function 024FEE95: HeapFree.KERNEL32(00000000), ref: 024FEEAF

Strings

C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 024F848C, 024F84A1

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe
API String ID: 359188348-3712348508
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 57e0a585f8af466b2f18bf718e8c77468ceb7bd7ee470d275e9e35f15bae483d
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: FD4181B2900109BFEB50EBA19E80EFF777DEB84304F0444ABE704DA150F7B05A988B60

Function 024FAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 024FAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 024FB00D

Part of subcall function 024FAF6F: gethostname.WS2_32(?,00000080), ref: 024FAF83
Part of subcall function 024FAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 024FAFE6

Part of subcall function 024F331C: gethostname.WS2_32(?,00000080), ref: 024F333F
Part of subcall function 024F331C: gethostbyname.WS2_32(?), ref: 024F3349

Part of subcall function 024FAA0A: inet_ntoa.WS2_32(00000000), ref: 024FAA10

Strings

%OUTLOOK_BND_, xrefs: 024FB076, 024FB07B, 024FB0BE, 024FB0DD

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 6c67656ecfee36a0685cebd46c3c3f7ec0befaaf91a2ae693f1d92d93231ff67
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 3E41607290020CAFDB61EFA1DC45EEE3B6DFF48304F14442BFA2592151EA75EA448F54

Function 024F9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 024F9536
Sleep.KERNEL32(000001F4), ref: 024F955D

Strings

, xrefs: 024F94D9

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 3d3aaffe0af8942e09e337ea3c7125b716f914edf360eda09c4142e6ef97bae7
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 1D412972C083997FEBB68B68D89C7A73FA49BC2318F1410A7D682572A2D7744981C711

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 024FBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 024FB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 024FBA3A
InterlockedIncrement.KERNEL32(?), ref: 024FBA94
GetTickCount.KERNEL32 ref: 024FBB79
GetTickCount.KERNEL32 ref: 024FBB99
InterlockedIncrement.KERNEL32(?), ref: 024FBE15
closesocket.WS2_32(00000000), ref: 024FBEB4

Strings

%FROM_EMAIL, xrefs: 024FBC7D

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: bd667fb0036900d3adb318375d01ecf2c7cb3a80b1f8e5fe3323589bf978ea6f
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 28317C71500248DFDFA5DFA5DC84AEAB7A9EB89704F20405BFB2482160EB30DA85CF10

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 024F709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 024F70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 024F70F4

Strings

|, xrefs: 024F70E6

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: ab2670516983cca0ee6db256ebadc1ce2e6803e9dc6c1fd48acecf2f3763383d
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: C0112A72900118EBDB52CFD4DD84ADFB7BCEB44305F1441A6E701E6294D7749B88CBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000C.00000002.2103702997.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 62cf705a705524b5481c3e56b905c2216abe02b2d19e69cd26a80eb50737c7aa
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 62cf705a705524b5481c3e56b905c2216abe02b2d19e69cd26a80eb50737c7aa
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 024F3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 024F2F88: GetModuleHandleA.KERNEL32(?), ref: 024F2FA1
Part of subcall function 024F2F88: LoadLibraryA.KERNEL32(?), ref: 024F2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 024F31DA
HeapFree.KERNEL32(00000000), ref: 024F31E1

Memory Dump Source

Source File: 0000000C.00000002.2105430301.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_24f0000_wuefhdgm.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 8147e6e128b689361e744be1c35b16ef96e8b44771509174dceaa996af349663
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: AE51BE3190028AEFCB41DF64D884AFABB75FF45304F1541AAED96D7210E732DA19CB90

Analysis Process: svchost.exePID: 6496, Parent PID: 5864COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1807
Total number of Limit Nodes:	18

Executed Functions

Function 0278C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0278CA4E
closesocket.WS2_32(?), ref: 0278CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0278CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0278CCB4
WriteFile.KERNEL32(0278A4B3,?,-000000E8,?,00000000), ref: 0278CCDC
CloseHandle.KERNEL32(0278A4B3), ref: 0278CCED
wsprintfA.USER32 ref: 0278CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0278CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0278CD89
CloseHandle.KERNEL32(?), ref: 0278CD98
CloseHandle.KERNEL32(?), ref: 0278CD9D
DeleteFileA.KERNEL32(?), ref: 0278CDC4
CloseHandle.KERNEL32(0278A4B3), ref: 0278CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0278CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0278CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0278D033
lstrcatA.KERNEL32(?,03F00108), ref: 0278D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0278D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0278D171
WriteFile.KERNEL32(00000000,03F0012C,?,?,00000000), ref: 0278D195
CloseHandle.KERNEL32(00000000), ref: 0278D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0278D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0278D231
lstrcatA.KERNEL32(?,03F00108,?,?,?,?,?,?,?,00000100), ref: 0278D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0278D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0278D2C7
WriteFile.KERNEL32(00000000,03F0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0278D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0278D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0278D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0278D372
lstrcatA.KERNEL32(?,03F00108,?,?,?,?,?,?,?,00000100), ref: 0278D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0278D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0278D408
WriteFile.KERNEL32(00000000,03F0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0278D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0278D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0278D45B
CreateProcessA.KERNEL32(?,02790264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0278D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0278D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0278D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0278D513
closesocket.WS2_32(?), ref: 0278D56C
Sleep.KERNEL32(000003E8), ref: 0278D577
ExitProcess.KERNEL32 ref: 0278D583
wsprintfA.USER32 ref: 0278D81F

Part of subcall function 0278C65C: send.WS2_32(00000000,?,00000000), ref: 0278C74B

closesocket.WS2_32(?), ref: 0278DAD5

Strings

.dat, xrefs: 0278D0D7, 0278D138, 0278D1AE, 0278D1D4, 0278D28E, 0278D308, 0278D3CF, 0278D441
\, xrefs: 0278D39D
.sys, xrefs: 0278D0CC
\, xrefs: 0278D3A7
@, xrefs: 0278D754
wtm_w, xrefs: 0278C96C
C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 0278CC10, 0278CCF3, 0278D975, 0278D98E
drivers\, xrefs: 0278D067
flags_upd, xrefs: 0278CE4A
localcfg, xrefs: 0278CA89, 0278CA93, 0278CAC0, 0278CAD2, 0278CE4F, 0278CE6F, 0278D8D3, 0278D8FC
4, xrefs: 0278D9F7
work_srv, xrefs: 0278D607, 0278D60F, 0278D62C
lid_file_upd, xrefs: 0278CE6A
wtm_r, xrefs: 0278C97F
except_info, xrefs: 0278D8CD, 0278D8D2, 0278D8FB
wtm_c, xrefs: 0278C956
time_cfg, xrefs: 0278C95B, 0278C962, 0278C971, 0278C984
local_time, xrefs: 0278CACD
srv_time, xrefs: 0278CABB

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-2402615725
Opcode ID: fa639f71d0819cdbb95d2e0b0fb0d48f34d9373b7af34f0421d0c165360cc539
Instruction ID: aa71ab638476704bda05e618cf2415a73d718b25637c6913823cf8cd226854df
Opcode Fuzzy Hash: fa639f71d0819cdbb95d2e0b0fb0d48f34d9373b7af34f0421d0c165360cc539
Instruction Fuzzy Hash: FFB2A3B2DC0309AFEB25BFA4DC49FEE7BB9EB04304F14446AE605A6180D7309955CF61

Function 02789A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 02789A7F
SetErrorMode.KERNELBASE(00000003), ref: 02789A83
SetUnhandledExceptionFilter.KERNEL32(02786511), ref: 02789A8A

Part of subcall function 0278EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0278EC5E
Part of subcall function 0278EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0278EC72
Part of subcall function 0278EC54: GetTickCount.KERNEL32 ref: 0278EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 02789AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 02789ABA
GetCommandLineA.KERNEL32 ref: 02789AFD
lstrlenA.KERNEL32(?), ref: 02789B99
ExitProcess.KERNEL32 ref: 02789C06
GetTempPathA.KERNEL32(000001F4,?), ref: 02789CAC
lstrcpyA.KERNEL32(?,00000000), ref: 02789D7A
lstrcatA.KERNEL32(?,?), ref: 02789D8B
lstrcatA.KERNEL32(?,0279070C), ref: 02789D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02789DED
DeleteFileA.KERNEL32(00000022), ref: 02789E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02789E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02789EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02789ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 02789F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 02789F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02789F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 02789FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02789FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02789FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0278A038
lstrcatA.KERNEL32(00000022,02790A34), ref: 0278A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0278A072
lstrcatA.KERNEL32(00000022,02790A34), ref: 0278A08D
wsprintfA.USER32 ref: 0278A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0278A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0278A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0278A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0278A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0278A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0278A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0278A1B6
GetCommandLineA.KERNEL32 ref: 0278A1E5

Part of subcall function 027899D2: lstrcpyA.KERNEL32(?,?,00000100,027922F8,00000000,?,02789E9D,?,00000022,?,?,?,?,?,?,?), ref: 027899DF
Part of subcall function 027899D2: lstrcatA.KERNEL32(00000022,00000000,?,?,02789E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 02789A3C
Part of subcall function 027899D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,02789E9D,?,00000022,?,?,?), ref: 02789A52

lstrlenA.KERNEL32(?), ref: 0278A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0278A3B7
GetLastError.KERNEL32 ref: 0278A3ED
Sleep.KERNELBASE(000003E8), ref: 0278A400
DeleteFileA.KERNELBASE(027933D8), ref: 0278A407
CreateThread.KERNELBASE(00000000,00000000,0278405E,00000000,00000000,00000000), ref: 0278A42C
WSAStartup.WS2_32(00001010,?), ref: 0278A43A
CreateThread.KERNELBASE(00000000,00000000,0278877E,00000000,00000000,00000000), ref: 0278A469
Sleep.KERNELBASE(00000BB8), ref: 0278A48A
GetTickCount.KERNEL32 ref: 0278A49F
GetTickCount.KERNEL32 ref: 0278A4B7
Sleep.KERNELBASE(00001A90), ref: 0278A4C3

Strings

", xrefs: 0278A078
", xrefs: 0278A189
D, xrefs: 02789F8E
bazwewbz, xrefs: 0278A389, 0278A397
\, xrefs: 02789D0C
C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 0278A1D9
", xrefs: 02789EDB
P, xrefs: 02789DAA
%X%08X, xrefs: 0278A0B0

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe$D$P$\$bazwewbz
API String ID: 2089075347-4239878819
Opcode ID: a645f9d0c8186bbf3c2de24d68ccfaf10f71980552677d1f3522a98e47a6ea14
Instruction ID: 6546e41da9cc0c89dba8eeec1c108ceb9185d0dcaa28eb99ecbb0a437ea32253
Opcode Fuzzy Hash: a645f9d0c8186bbf3c2de24d68ccfaf10f71980552677d1f3522a98e47a6ea14
Instruction Fuzzy Hash: 835272B2DC0359EFDF21BBA4CC49EEE7BBDAB04304F1444A6F609A2141E7709A558F61

Function 0278199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 027819B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,02781E9E), ref: 027819BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 027819E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 027819ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 027819F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,02781E9E), ref: 02781A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,02781E9E), ref: 02781A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,02781E9E), ref: 02781A36
GetAdaptersInfo.IPHLPAPI(00000000,02781E9E,?,?,?,?,00000001,02781E9E), ref: 02781A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,02781E9E,?,?,?,?,00000001,02781E9E), ref: 02781A5A
GetAdaptersInfo.IPHLPAPI(00000000,02781E9E,?,?,?,?,00000001,02781E9E), ref: 02781A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,02781E9E), ref: 02781A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,02781E9E), ref: 02781AA4

Strings

Iphlpapi.dll, xrefs: 027819B7
GetIfEntry, xrefs: 027819E4
123.45.67.89, xrefs: 027819A6
GetAdaptersInfo, xrefs: 027819DC
GetBestInterface, xrefs: 027819EF
localcfg, xrefs: 027819A3

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: ef8fd99879fdb9015d2383c5e194a642582e9c41e0ae20a823770d74d16727f6
Instruction ID: 7f89764c4b23953107eb84ea531532cdf5901371166ecc879c891e63825b31f1
Opcode Fuzzy Hash: ef8fd99879fdb9015d2383c5e194a642582e9c41e0ae20a823770d74d16727f6
Instruction Fuzzy Hash: C1318E72D90219AFDF11EFE4DC888BEBFB9EF45205B94497AE509E3110D7304A42CBA5

Function 02787A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 02787ABA
GetUserNameA.ADVAPI32(?,?), ref: 02787ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0279070C,?,?,?), ref: 02787B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 02787B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 02787B59
EqualSid.ADVAPI32(?,00000022), ref: 02787B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 02787B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02787B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02787B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 02787BAB
LocalFree.KERNEL32(00000000), ref: 02787BB2
GetSecurityDescriptorDacl.ADVAPI32(?,02787FC9,?,00000000), ref: 02787BCE

Strings

C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 02787CE2, 02787D0F, 02787D23, 02787D24
D, xrefs: 02787B0C

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe$D
API String ID: 2976863881-489978695
Opcode ID: 2b85095bba823048d91f7c6ec8c6ea4eceac0b9e8e445f6e29716f5dc1cd394d
Instruction ID: fef07e4fd81563e515092f4824e3de7b97f8e3f4ea35a5410eec2aafda55de49
Opcode Fuzzy Hash: 2b85095bba823048d91f7c6ec8c6ea4eceac0b9e8e445f6e29716f5dc1cd394d
Instruction Fuzzy Hash: 48A16E76D80219AFDF15AFA5DC88FEEBBBDFB44304F148469E606E2140E7318A55CB60

Function 02787809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0278782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02787866
GetLengthSid.ADVAPI32(?), ref: 02787878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0278789A
GetSecurityDescriptorOwner.ADVAPI32(?,02787F63,?), ref: 027878B8
EqualSid.ADVAPI32(?,02787F63), ref: 027878D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 027878E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 027878F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02787901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02787910
LocalFree.KERNEL32(00000000), ref: 02787917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02787933
GetAce.ADVAPI32(?,00000000,?), ref: 02787963
EqualSid.ADVAPI32(?,02787F63), ref: 0278798A
DeleteAce.ADVAPI32(?,00000000), ref: 027879A3
EqualSid.ADVAPI32(?,02787F63), ref: 027879C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 02787A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02787A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02787A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02787A79
LocalFree.KERNEL32(00000000), ref: 02787A87

Strings

D, xrefs: 0278785C

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: f0f9ae889aac0b14b3ff67ba7f886f8d393a2d2fd3993bb7b46bb582fa045a79
Instruction ID: 23d7456b1ecc38d3889fd692108de19b0c0f80436842cd3fe6d81a5c9174f82b
Opcode Fuzzy Hash: f0f9ae889aac0b14b3ff67ba7f886f8d393a2d2fd3993bb7b46bb582fa045a79
Instruction Fuzzy Hash: EE815C76D80219AFDB21DFA9CD44FEEBBB8EF08344F24856AE506E2140E7348651CF65

Function 02788328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,02790750,?,?,00000000,localcfg,00000000), ref: 027883F3
RegQueryValueExA.KERNELBASE(02790750,?,00000000,?,02788893,?,?,?,00000000,00000103,02790750,?,?,00000000,localcfg,00000000), ref: 02788414
RegSetValueExA.KERNELBASE(02790750,?,00000000,00000004,02788893,00000004,?,?,00000000,00000103,02790750,?,?,00000000,localcfg,00000000), ref: 02788441
RegCloseKey.ADVAPI32(02790750,?,?,00000000,00000103,02790750,?,?,00000000,localcfg,00000000), ref: 0278844A

Strings

C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 027885C8, 027885D5, 027885E5
localcfg, xrefs: 02788348

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe$localcfg
API String ID: 237177642-767073137
Opcode ID: 9859b9d0467871625c471ede651f03ea07194cc306778ad409595128a15e6fa2
Instruction ID: 71660585584b0da60b8fda52d1316b9e68b0487cbe08e5aee059125751a03dde
Opcode Fuzzy Hash: 9859b9d0467871625c471ede651f03ea07194cc306778ad409595128a15e6fa2
Instruction Fuzzy Hash: 3CC18DB2DC024DBFEB12BBA49C89EEE7BBDEB05304F544465F605A2041E7304A95CF62

Function 02781D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 02781DC6
GetSystemInfo.KERNELBASE(?), ref: 02781DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 02781E03
GetProcAddress.KERNEL32(00000000), ref: 02781E0A
GetCurrentProcess.KERNEL32(?), ref: 02781E1B
GetTickCount.KERNEL32 ref: 02781FC9

Part of subcall function 02781BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 02781C15

Strings

IsWow64Process, xrefs: 02781DF2
work_srv, xrefs: 02781E5E
born_date, xrefs: 02781EAD, 02781ECC
lid_file_upd, xrefs: 02781E25
loader_id, xrefs: 02781F4B, 02781F6B
start_srv, xrefs: 02781E6C
hi_id, xrefs: 02781F16, 02781F1B, 02781F33
flags_upd, xrefs: 02781E3E, 02781E43, 02781E7C
net_type, xrefs: 02781E87
kernel32, xrefs: 02781DF7
localcfg, xrefs: 02781E2A, 02781E31, 02781E44, 02781E7D, 02781E8C, 02781EB2, 02781ED1, 02781EE7, 02781EFF, 02781F1C, 02781F34, 02781F50, 02781F70

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 48fa9ba05078bb1c04bee84acea0692f517ed83406beb6647c7378711f836f2c
Instruction ID: 504e0323d3cc0e74f0ab8ced75bca331412d8b49b7aeb3f376a87e4a05c848df
Opcode Fuzzy Hash: 48fa9ba05078bb1c04bee84acea0692f517ed83406beb6647c7378711f836f2c
Instruction Fuzzy Hash: 4C51C3B19843446FE720BF798C89F2BBAECEF45708F44491DF58A82242D774A505CB61

Function 027873FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 02787472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 027874F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 02787528
___ascii_stricmp.LIBCMT ref: 0278764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 027876E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 02787706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 02787717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 02787745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 027877EF

Part of subcall function 0278F1A5: lstrlenA.KERNEL32(000000C8,000000E4,027922F8,000000C8,02787150,?), ref: 0278F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0278778F
RegCloseKey.KERNELBASE(?), ref: 027877E6

Strings

", xrefs: 02787599

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: bc4d7f5e5794d85ef1d520008dc95403acdde0aa1c1422d221f254aaf2a34baf
Instruction ID: d51f4fed55acf99638f450e6a70f9d9e9e97fe0560dc52ea2164baa5fa56bdaf
Opcode Fuzzy Hash: bc4d7f5e5794d85ef1d520008dc95403acdde0aa1c1422d221f254aaf2a34baf
Instruction Fuzzy Hash: FFC1E476980209AFEB16AFA4DC48FEEBBB9EF45310F240495F505E6190EB31DA44CF60

Function 0278675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0278677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0278679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 027867B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 027867BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 027867D3
ReadFile.KERNELBASE(000000FF,?,00000040,02788244,00000000,?,75920F10,00000000), ref: 02786807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0278681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0278683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0278685C
ReadFile.KERNEL32(000000FF,?,00000028,02788244,00000000,?,75920F10,00000000), ref: 0278688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 02786906
ReadFile.KERNEL32(000000FF,?,00000000,02788244,00000000,?,75920F10,00000000), ref: 0278691C
CloseHandle.KERNELBASE(000000FF,?,75920F10,00000000), ref: 02786971

Part of subcall function 0278EC2E: GetProcessHeap.KERNEL32(00000000,0278EA27,00000000,0278EA27,00000000), ref: 0278EC41
Part of subcall function 0278EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0278EC48

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: aa5226c654be36033d54768b8aeaee8546e23b12bdfa2df21bcca6271c108a0e
Instruction ID: 7f480686ff1264994820e89621fb2182a9db6b6dc034cb7f003c47d0f0811a46
Opcode Fuzzy Hash: aa5226c654be36033d54768b8aeaee8546e23b12bdfa2df21bcca6271c108a0e
Instruction Fuzzy Hash: 5F7114B1C40219FFDF15AFA8CC85AEEBBB9FB04314F10456AE515A6190E7309E92CF60

Function 0278F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(0278CA1D), ref: 0278F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0278F367
closesocket.WS2_32(00000000), ref: 0278F375

Strings

time_cfg, xrefs: 0278F323

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 3c02a5e7d98d8e2ac09b0e6f019834d7a2735aa8a69660f91378173ca64cb440
Instruction ID: 029859d01bc90392895896c3d1449b70cc83b8933b9f8d14ea42e0b6b2c1edb4
Opcode Fuzzy Hash: 3c02a5e7d98d8e2ac09b0e6f019834d7a2735aa8a69660f91378173ca64cb440
Instruction Fuzzy Hash: 1B317E72990218ABDB11EFA5DC849EF7BBCFF48310F104566F919E3140E7309A518BA1

Function 0278405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02784070
ExitProcess.KERNEL32 ref: 02784121

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: dd76f79f7855ac196bdaeb0c1ce13ce6cac29d05e284a136444a0e08992146df
Instruction ID: 25cf814ff8d18f8e2faddf4560076df8027c536b1baaf0add7f0cb0be1c3ac3a
Opcode Fuzzy Hash: dd76f79f7855ac196bdaeb0c1ce13ce6cac29d05e284a136444a0e08992146df
Instruction Fuzzy Hash: F25191B1D9021ABBEB21BAA48C89FBF7B7DEF11714F004065F614F6180E7758A11CBA1

Function 02782D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,02782F01,?,027820FF,02792000), ref: 02782D3A
LoadLibraryA.KERNEL32(?), ref: 02782D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02782D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 02782D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 02782D99
HeapAlloc.KERNEL32(00000000), ref: 02782DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 02782DCB

Strings

DnsQuery_A, xrefs: 02782D5B
dnsapi.dll, xrefs: 02782D29

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: e494084d07aa543453d67a892677b8a2fd18b73cb0938dcada6e033459da9047
Instruction ID: 660e3db477de115205cf9836dda0fea6f6d86970121b980057374e6006ba4140
Opcode Fuzzy Hash: e494084d07aa543453d67a892677b8a2fd18b73cb0938dcada6e033459da9047
Instruction Fuzzy Hash: 68219271D80225BBCB21AF56DC44AAEBFB8FF08751F104412FD05E3101E37099828BE0

Function 027880C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0278815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0278A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02788187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0278A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 027881BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02788210

Part of subcall function 0278675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0278677E
Part of subcall function 0278675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0278679A
Part of subcall function 0278675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 027867B0
Part of subcall function 0278675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 027867BF
Part of subcall function 0278675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 027867D3
Part of subcall function 0278675C: ReadFile.KERNELBASE(000000FF,?,00000040,02788244,00000000,?,75920F10,00000000), ref: 02786807
Part of subcall function 0278675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0278681F
Part of subcall function 0278675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0278683E
Part of subcall function 0278675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0278685C

Part of subcall function 0278EC2E: GetProcessHeap.KERNEL32(00000000,0278EA27,00000000,0278EA27,00000000), ref: 0278EC41
Part of subcall function 0278EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0278EC48

Strings

C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe, xrefs: 02788225, 0278823A

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe
API String ID: 124786226-3712348508
Opcode ID: 74337b4e1b6239898beaa090de9d5e37c074a4ecf942dac76d856ae83633dd87
Instruction ID: 22f6e0e006cccdebf0387add11a6c83df17a7c5b4fa4eb93eb2f763b66993728
Opcode Fuzzy Hash: 74337b4e1b6239898beaa090de9d5e37c074a4ecf942dac76d856ae83633dd87
Instruction Fuzzy Hash: D6417FB2DC520DBFEB11FBA49D84EBF77ADAB05304F54486AE905A2001E7305A55CB62

Function 02781AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02781AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02781AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02781B20

Strings

GetAdaptersAddresses, xrefs: 02781AE3
Iphlpapi.dll, xrefs: 02781ACC

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: b7a0b61c47ed040b2681e7d6f1112950353eb16af331ff6f9d65a2f215b6d682
Instruction ID: 38267d7247ab3fdc25d20bfd86990ea697f8f3d04efd23240b75c56632a21d77
Opcode Fuzzy Hash: b7a0b61c47ed040b2681e7d6f1112950353eb16af331ff6f9d65a2f215b6d682
Instruction Fuzzy Hash: 8F119672E81238AFDB15ABA9DC85CEEBFBAEB44B10F944055E009E7100E7305A42CB94

Function 0278E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,0278E5F2,00000000,00020119,0278E5F2,027922F8), ref: 0278E3E6
RegQueryValueExA.ADVAPI32(0278E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0278E44E
RegQueryValueExA.ADVAPI32(0278E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0278E482
RegQueryValueExA.ADVAPI32(0278E5F2,?,00000000,?,80000001,?), ref: 0278E4CF
RegCloseKey.ADVAPI32(0278E5F2,?,?,?,?,000000C8,000000E4), ref: 0278E520

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 063cc981383481cdfb04b924b430b74cdd71ef9dcd3783b48b84ffb5750830c4
Instruction ID: ff4a27cee9732e969ffd2ea6951b4ab65b8df46030f8a5609709c092fdac9dfa
Opcode Fuzzy Hash: 063cc981383481cdfb04b924b430b74cdd71ef9dcd3783b48b84ffb5750830c4
Instruction Fuzzy Hash: 2441F7B2D4021DAFEF11AFD8DC84DEEBBBDEB08344F544566FA14A2150E3319A558B60

Function 0278F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0278F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0278F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0278F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0278F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0278F2FD

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 6a433826af33782946d5a7465b2b9ba9a87c77c73ae4d35bb2f318736e7ea3f3
Instruction ID: bfe63e96b519175b7071e7268763550782f27acc10559af7cc21d27cc8ae9fab
Opcode Fuzzy Hash: 6a433826af33782946d5a7465b2b9ba9a87c77c73ae4d35bb2f318736e7ea3f3
Instruction Fuzzy Hash: 2911FBB1A40248BAEB11DE94CD41FAE7FBCEB44751F008066BB04EA1D0E6B19A45CB94

Function 02781BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02781AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02781AD4
Part of subcall function 02781AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02781AE9
Part of subcall function 02781AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02781B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02781C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 02781C51

Strings

hi_id, xrefs: 02781BE5
localcfg, xrefs: 02781BE7

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: b55c20ec8f58696b57a0cbdf570346cb042babf2d2f20e0000aae3559f40d22d
Instruction ID: 998299a7db7bece04c4bb3da533982527aeb0b0cf0778647ec424c1eb09274d9
Opcode Fuzzy Hash: b55c20ec8f58696b57a0cbdf570346cb042babf2d2f20e0000aae3559f40d22d
Instruction Fuzzy Hash: 930192B6A41218BFEB10EAF8C8C59FFBBBDEB44655F504475E706E3100D2309E4596A1

Function 02781B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 02781AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02781AD4
Part of subcall function 02781AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02781AE9
Part of subcall function 02781AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02781B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02781BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,02781EFD,00000000,00000000,00000000,00000000), ref: 02781BB8

Strings

localcfg, xrefs: 02781B7B

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: a04a4d437a3c7326f193258d9581dc532384d9d69a5e28d75af6a4b32de27cae
Instruction ID: 8ac600d8151cb8072cbce8cd869f62f61650e89c252d032a50b8103415dbb008
Opcode Fuzzy Hash: a04a4d437a3c7326f193258d9581dc532384d9d69a5e28d75af6a4b32de27cae
Instruction Fuzzy Hash: 6B01ADB7D4010CBFEB01ABE9C8859EFFBBDEB48660F150462AB01F3140D6705E098AA0

Function 02782684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 02782693
gethostbyname.WS2_32(00000001), ref: 0278269F

Strings

time_cfg, xrefs: 02782684

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 62f8b773567394ee1da71d13b0c3953b868502aa665a1a29d889c824cfed522f
Instruction ID: 3579455a8e33d5ba5669778a1beb12f156b61a822cf49026b7cec49a6e5d2e02
Opcode Fuzzy Hash: 62f8b773567394ee1da71d13b0c3953b868502aa665a1a29d889c824cfed522f
Instruction Fuzzy Hash: 70E0C230B541518FCB10AB28F444BD677E4EF06231F018581F840D3191C730DC818780

Function 0278E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0278DD05: GetTickCount.KERNEL32 ref: 0278DD0F
Part of subcall function 0278DD05: InterlockedExchange.KERNEL32(027936B4,00000001), ref: 0278DD44
Part of subcall function 0278DD05: GetCurrentThreadId.KERNEL32 ref: 0278DD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,0278A445), ref: 0278E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,75920F10,?,00000000,?,0278A445), ref: 0278E583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,0278A445), ref: 0278E5B2

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: e66d1ea57bb4758ddfaf95a09c6f1c0617367b5486181081d56408e16f2dc16b
Instruction ID: 7b43a9a22b102fdee465632c68ebf67200cefaf3a8171b9f5d130d2b1bc007a1
Opcode Fuzzy Hash: e66d1ea57bb4758ddfaf95a09c6f1c0617367b5486181081d56408e16f2dc16b
Instruction Fuzzy Hash: 1521D3F2AC03117BF6227A35AC4AFAB3E5DDB55750F100454BE0EA11D3EB61D9208AF1

Function 0278877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 027888A5

Part of subcall function 0278F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0278E342,00000000,7508EA50,80000001,00000000,0278E513,?,00000000,00000000,?,000000E4), ref: 0278F089
Part of subcall function 0278F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0278E342,00000000,7508EA50,80000001,00000000,0278E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0278F093

Strings

rresolv, xrefs: 027887F6, 0278885C
localcfg, xrefs: 027887CA, 027887CF, 027887FB, 02788835, 02788861

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 3b0be8bfb05bb357e193c38a70b128c36299e23bfb04b8969bb32d822008eb9b
Instruction ID: 67b394e87302917e5dd9ccc5b2129b064811dba9142b693032d4021727241c27
Opcode Fuzzy Hash: 3b0be8bfb05bb357e193c38a70b128c36299e23bfb04b8969bb32d822008eb9b
Instruction Fuzzy Hash: 2721D731AC83057AF715F7656C4AB6E3ADBAB11724FD04819FD04950C2EBB1459089B3

Function 02784000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,027922F8,027842B6,00000000,00000001,027922F8,00000000,?,027898FD), ref: 02784021
GetLastError.KERNEL32(?,027898FD,00000001,00000100,027922F8,0278A3C7), ref: 0278402C
Sleep.KERNEL32(000001F4,?,027898FD,00000001,00000100,027922F8,0278A3C7), ref: 02784046

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: ed9e71ea978efb84af901d2f25a33cc8c32da50dd5e5816baf26a1341398b231
Instruction ID: a719d5171d6f9bc880225363ef123fab9c6af477d2e9ac6dfee5f9e43b2ff454
Opcode Fuzzy Hash: ed9e71ea978efb84af901d2f25a33cc8c32da50dd5e5816baf26a1341398b231
Instruction Fuzzy Hash: 64F0A7326D02026AD7312A38AC59B1B3265EB81728F268B64F3B5F20D0C7B044829B14

Function 0278DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0278DC19,?,00000104), ref: 0278DB7F
lstrcpyA.KERNEL32(?,027928F8), ref: 0278DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 0278DBC2

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: f8144a358539f04e898a0ed648f3b667d8116d7eafc73a1e4c35646a5c346090
Instruction ID: 6a4eedc5dd3d215b82891c52f01ca08862f0b9f98c29976ff600357d946fb357
Opcode Fuzzy Hash: f8144a358539f04e898a0ed648f3b667d8116d7eafc73a1e4c35646a5c346090
Instruction Fuzzy Hash: 9EF09070590309ABEF219F64DC89FD93B69AB00318F104594BB51A40D0D7F2D555CB10

Function 0278EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0278EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0278EC72
GetTickCount.KERNEL32 ref: 0278EC78

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 04eacb30b39b773a1e2ee310b0da672ce72980a71a64a675736d1bf37d566c8d
Instruction ID: 686678ae5b72d4a9a1920c5e4c93bd2ae7fa3c9392e30016cdc49f6979683771
Opcode Fuzzy Hash: 04eacb30b39b773a1e2ee310b0da672ce72980a71a64a675736d1bf37d566c8d
Instruction Fuzzy Hash: 39E09AF5C60204BFE701ABB4DC4AE6B77BCEB08314F504A50B915D6090DA709A258B60

Function 027830B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 027830D8
gethostbyname.WS2_32(?), ref: 027830E2

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 99bd763834fa2a32c48b90fa8f9077d280b5e078b7e31eb33624b0aeb9cfd2d7
Instruction ID: 5734f604ffe2e8c7c0d288ee155f77bfd7bbd8636e7b6c5cfa9785eb72e8e73d
Opcode Fuzzy Hash: 99bd763834fa2a32c48b90fa8f9077d280b5e078b7e31eb33624b0aeb9cfd2d7
Instruction Fuzzy Hash: BEE09272D40219ABCF10EBA8EC89F9B77ECFF04308F084461F905E3280EA34E5058BA0

Function 0278EC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0278EBA0: GetProcessHeap.KERNEL32(00000000,00000000,0278EC0A,00000000,80000001,?,0278DB55,7FFF0001), ref: 0278EBAD
Part of subcall function 0278EBA0: HeapSize.KERNEL32(00000000,?,0278DB55,7FFF0001), ref: 0278EBB4

GetProcessHeap.KERNEL32(00000000,0278EA27,00000000,0278EA27,00000000), ref: 0278EC41
RtlFreeHeap.NTDLL(00000000), ref: 0278EC48

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: a63da22e0e277acee7688927bda09d5bef05ec74dd03a79f54a8ae09b5d08933
Instruction ID: bfbff413e12619d123572b9ca7b5332b55297ec6faa37b693f10cd75319d1c35
Opcode Fuzzy Hash: a63da22e0e277acee7688927bda09d5bef05ec74dd03a79f54a8ae09b5d08933
Instruction Fuzzy Hash: 51C01232CD73306BC5523A51B80CF9F6B599F46611F094809F50566044877058414AE1

Function 0278EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0278EBFE,7FFF0001,?,0278DB55,7FFF0001), ref: 0278EBD3
RtlAllocateHeap.NTDLL(00000000,?,0278DB55,7FFF0001), ref: 0278EBDA

Part of subcall function 0278EB74: GetProcessHeap.KERNEL32(00000000,00000000,0278EC28,00000000,?,0278DB55,7FFF0001), ref: 0278EB81
Part of subcall function 0278EB74: HeapSize.KERNEL32(00000000,?,0278DB55,7FFF0001), ref: 0278EB88

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: e0816d31f4b4ccf961f93ec210532b281cf314c7b8412e5180db5c93e3f5c530
Instruction ID: be9753c508c6c2eba1e28c5a1722780abe2a0dec67f5e16db6b1188e6bee31ac
Opcode Fuzzy Hash: e0816d31f4b4ccf961f93ec210532b281cf314c7b8412e5180db5c93e3f5c530
Instruction Fuzzy Hash: FEC080325C432067C60137E47C0CF9E3E94DF04362F044414F505C1154C73048518F95

Function 0278F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,0278CA44), ref: 0278F476

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 15145421b0c86e3efe41141e75ac99e8595260dde416496ce26021ae827c6ffb
Instruction ID: 43ee714b25d20f7f3d6c165692dc773d9a53231d4ae64b77597f1bd59933fac3
Opcode Fuzzy Hash: 15145421b0c86e3efe41141e75ac99e8595260dde416496ce26021ae827c6ffb
Instruction Fuzzy Hash: 59F01C7324155EAB9B11AE9ADC84CAB3BAEFB892507444522FA18D7110D631E8218BA1

Function 02781978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 02781992

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 305b7f274e190ae89ccd47594ace0ee1aa4f90ed198fed2e10708cb2607b852c
Instruction ID: 5217583be70e07139d9324178a4b6c07b782ee4c09b9bc3b8fe1760aa75eb9d4
Opcode Fuzzy Hash: 305b7f274e190ae89ccd47594ace0ee1aa4f90ed198fed2e10708cb2607b852c
Instruction Fuzzy Hash: 75D012265886316A52113759BC0447FBB9CDF45662751941BFC4CC0150D734C8428796

Function 0278DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 0278DDB5

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 6bdbb1c806b664c7086614e4e21af42538039a910bf7be90f760ce96e6df0c32
Instruction ID: 418b7583741ed72bb9b64460745f23208c1af0d56b93a0619f2b4f8fda4a4d89
Opcode Fuzzy Hash: 6bdbb1c806b664c7086614e4e21af42538039a910bf7be90f760ce96e6df0c32
Instruction Fuzzy Hash: 01F0FE31644302ABCB30AE7A9844656B7E5AB46329F15492BE55992280E730D855CB71

Non-executed Functions

Function 0278637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02789816,EntryPoint), ref: 0278638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,02789816,EntryPoint), ref: 027863A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 027863CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 027863EB

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 76bc46bb0f73cb8319e6989d41ec167b33b1f4d7f609d648d2c80366d68dad3b
Instruction ID: 78a3001fd3a607dea1c17c00e1f8b313d8b8a984e8770e2a6722284cb3ade134
Opcode Fuzzy Hash: 76bc46bb0f73cb8319e6989d41ec167b33b1f4d7f609d648d2c80366d68dad3b
Instruction Fuzzy Hash: AC11A3B2A80219BFEB11AF65DC49F9B3BACEF047A4F004424F918E7280D770DC108BA0

Function 02781000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,02781839,02789646), ref: 02781012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 027810C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 027810E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 02781101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 02781121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 02781140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 02781160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 02781180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0278119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 027811BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 027811DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 027811FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0278121A

Strings

RtlLengthSid, xrefs: 02781246
NtSetInformationToken, xrefs: 02781175
NtFilterToken, xrefs: 0278122B
ntdll.dll, xrefs: 0278100D
NtQueryInformationToken, xrefs: 02781262
RtlNtStatusToDosError, xrefs: 02781194
NtClose, xrefs: 027811B4
RtlExpandEnvironmentStrings_U, xrefs: 027810BC
NtTerminateProcess, xrefs: 027810F6
RtlSetLastWin32Error, xrefs: 027810D6
NtSetInformationThread, xrefs: 02781155
RtlInitUnicodeString, xrefs: 02781135
RtlFreeSid, xrefs: 02781116
NtDuplicateToken, xrefs: 027811F3
RtlAllocateAndInitializeSid, xrefs: 0278120F
NtOpenProcessToken, xrefs: 027811D4

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 83a832b35bf3fb0e159f986739103d4ce9d0495d5d661a77d250131180bc335a
Instruction ID: f843ee8894355dd6ed26414fa4dc3815f2e949be4e6227e5e5875a3ebfe5e972
Opcode Fuzzy Hash: 83a832b35bf3fb0e159f986739103d4ce9d0495d5d661a77d250131180bc335a
Instruction Fuzzy Hash: 3C512571AC6702AEEB11EBADAC4476237E4674837CF548B96D829D21D0D7B0C4A3CF52

Function 0278B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0278B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0278B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0278B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0278B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0278B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0278B329
wsprintfA.USER32 ref: 0278B3B7

Strings

Nov, xrefs: 0278B29C
Mon, xrefs: 0278B22C
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0278B3AF
Dec, xrefs: 0278B2A3
Jun, xrefs: 0278B279
Wed, xrefs: 0278B23A
Apr, xrefs: 0278B26B
Oct, xrefs: 0278B295
Mar, xrefs: 0278B264
Feb, xrefs: 0278B25D
Fri, xrefs: 0278B248
Sat, xrefs: 0278B24F
Aug, xrefs: 0278B287
Tue, xrefs: 0278B233
Sun, xrefs: 0278B225
Jul, xrefs: 0278B280
Thu, xrefs: 0278B241
Sep, xrefs: 0278B28E
May, xrefs: 0278B272
Jan, xrefs: 0278B256

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 7e364d67b40c7ac1326dd6b790ed0244ef466387fb21f675e24e45dd7dacf41c
Instruction ID: ab29276ed4a9203574ab43b55f4d8d953c780d3513c78242d91c1256cff81998
Opcode Fuzzy Hash: 7e364d67b40c7ac1326dd6b790ed0244ef466387fb21f675e24e45dd7dacf41c
Instruction Fuzzy Hash: BC516BB2E5131DAACF10DFD4E9889EFBBB9FF4A308F114469E611B6150D3344A89CB90

Function 02786511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0278654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0278655C
htonl.WS2_32(?), ref: 02786578
htonl.WS2_32(?), ref: 02786587
wsprintfA.USER32 ref: 0278659B
wsprintfA.USER32 ref: 027865DC
wsprintfA.USER32 ref: 02786671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0278668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 02786696
wsprintfA.USER32 ref: 027866B0
wsprintfA.USER32 ref: 027866E7
wsprintfA.USER32 ref: 027866FF
wsprintfA.USER32 ref: 0278671F
ExitProcess.KERNEL32 ref: 02786755

Strings

ver=%d date=%s %sc=%08x a=%p, xrefs: 02786547
plgs:, xrefs: 027866AA
12:08:32, xrefs: 02786535
Jan 13 2018, xrefs: 0278653A
va=%08X%08X uef=%p, xrefs: 02786595
except_info, xrefs: 02786728
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 027865D6
%d=%p, xrefs: 027866F9
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0278666B
localcfg, xrefs: 0278672D

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: ad5a36bf356b9f2635808ece776dff60d52cebccb706114f374e1085e319269c
Instruction ID: 2486ea615151879239a06f304f04e2d00c9faf5b56178371bf736bcfc581e8bf
Opcode Fuzzy Hash: ad5a36bf356b9f2635808ece776dff60d52cebccb706114f374e1085e319269c
Instruction Fuzzy Hash: C8612CB2A90318AFEF60AFA4DC45FEA77E9FF08300F148469F969D2151DB7199508F50

Function 0278A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0278A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0278A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0278A893
wsprintfA.USER32 ref: 0278A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0278A8D2
wsprintfA.USER32 ref: 0278A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0278A97C
wsprintfA.USER32 ref: 0278A9B9

Strings

AUTH LOGIN, xrefs: 0278A80C
helo %s, xrefs: 0278A803
Too big smtp respons (%d bytes), xrefs: 0278A9B1
ehlo %s, xrefs: 0278A7F5
data, xrefs: 0278A85E
localcfg, xrefs: 0278AB0B
rcpt to:<%s>, xrefs: 0278A855
Too small respons, xrefs: 0278A9C9
mail from:<%s>, xrefs: 0278A848
Error sending command (sent = %d/%d), xrefs: 0278A8A7, 0278A8DA
., xrefs: 0278A8CA
quit, xrefs: 0278A86C
ESMTP, xrefs: 0278AA38
Incorrect respons, xrefs: 0278AB39

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 8d93729614a32f1d0baffe3220af607f15f3abf60f73eb2deaf6b5213c66eedf
Instruction ID: f023fc3a68658d182070cde6dbd41739737ca03c46b879cf9e255f895142b6a7
Opcode Fuzzy Hash: 8d93729614a32f1d0baffe3220af607f15f3abf60f73eb2deaf6b5213c66eedf
Instruction Fuzzy Hash: 19A13B72DC4305ABEF22BA54DC89FAE3F6AEB00308F144467F906B6090EB719955CB59

Function 02781280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0278139A
lstrlenW.KERNEL32(-00000003), ref: 02781571

Strings

, xrefs: 02781462
%systemroot%\system32\cmd.exe, xrefs: 02781316
D, xrefs: 027815C6
uac, xrefs: 02781628
@, xrefs: 02781380
wusa.exe, xrefs: 02781388
PDGu, xrefs: 0278139A
<, xrefs: 02781378
useless, xrefs: 0278161E

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: fc191f300d8a4b99cca93bfdc146d7f6693b33f76a2d52d54b258d8690d7b53d
Instruction ID: 5b2ee149f910a4ee0e4b651e53de62aa53f7b688ee8cc924a9512de67c75af0f
Opcode Fuzzy Hash: fc191f300d8a4b99cca93bfdc146d7f6693b33f76a2d52d54b258d8690d7b53d
Instruction Fuzzy Hash: 8AF18EB56883419FD720EF64C888B6BB7E5FB88304F448D2DF99A97280D774D846CB52

Function 02782A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 02782A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 02782A86
socket.WS2_32(00000002,00000002,00000011), ref: 02782AA0
htons.WS2_32(00000000), ref: 02782ADB
select.WS2_32 ref: 02782B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 02782B4A
htons.WS2_32(?), ref: 02782B71
htons.WS2_32(?), ref: 02782B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02782BFB

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 181dff274111ee0fcbbf9254d6bd5aedb7921aa77c474af67324bc1f467d1541
Instruction ID: 1428b7c9a85cf875298926d3faffa85537f52966e326a43ccf43e6ce05ff9940
Opcode Fuzzy Hash: 181dff274111ee0fcbbf9254d6bd5aedb7921aa77c474af67324bc1f467d1541
Instruction Fuzzy Hash: AA61DFB1985344AFD720AF65DC08B3BBBE8FF88756F004809FE4997152D7B0D8418BA2

Function 0278704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 027870C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0278719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 027871B2
RegCloseKey.ADVAPI32(75920F10), ref: 02787208
RegCloseKey.ADVAPI32(75920F10), ref: 02787291
___ascii_stricmp.LIBCMT ref: 027872C2
RegCloseKey.ADVAPI32(75920F10), ref: 027872D0
RegCloseKey.ADVAPI32(75920F10), ref: 02787314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0278738D
RegCloseKey.ADVAPI32(75920F10), ref: 027873D8

Part of subcall function 0278F1A5: lstrlenA.KERNEL32(000000C8,000000E4,027922F8,000000C8,02787150,?), ref: 0278F1AD

Strings

", xrefs: 02787227
, xrefs: 02787194

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: a2945cc3fc535bea8c11b37fbd3cbd638ba3afed8fa898ab31aba5def27063f3
Instruction ID: 9069a8ae4b976cbdd2a7a464dda8fbbe92af8ba55c8b7970cf583e10c1f5dbfe
Opcode Fuzzy Hash: a2945cc3fc535bea8c11b37fbd3cbd638ba3afed8fa898ab31aba5def27063f3
Instruction Fuzzy Hash: FCB19476D84209ABDF19BFA4DC48BEFB7B9AF04314F200465F501E6190EB719A44CB61

Function 0278AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0278AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0278ADA6

Part of subcall function 0278AD08: gethostname.WS2_32(?,00000080), ref: 0278AD1C
Part of subcall function 0278AD08: lstrlenA.KERNEL32(00000000), ref: 0278AD60
Part of subcall function 0278AD08: lstrlenA.KERNEL32(00000000), ref: 0278AD69
Part of subcall function 0278AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0278AD7F

Part of subcall function 027830B5: gethostname.WS2_32(?,00000080), ref: 027830D8
Part of subcall function 027830B5: gethostbyname.WS2_32(?), ref: 027830E2

wsprintfA.USER32 ref: 0278AEA5

Part of subcall function 0278A7A3: inet_ntoa.WS2_32(?), ref: 0278A7A9

wsprintfA.USER32 ref: 0278AE4F
wsprintfA.USER32 ref: 0278AE5E

Part of subcall function 0278EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0278EF92
Part of subcall function 0278EF7C: lstrlenA.KERNEL32(?), ref: 0278EF99
Part of subcall function 0278EF7C: lstrlenA.KERNEL32(00000000), ref: 0278EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0278AE9F
%OUTLOOK_BND_, xrefs: 0278AE0F, 0278AE14, 0278AE57, 0278AE76
%OUTLOOK_MID, xrefs: 0278AEAE
%OUTLOOK_HST, xrefs: 0278AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0278AE49
%s%d, xrefs: 0278AE58
127.0.0.1, xrefs: 0278ADEB

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: 602290d42e7350694ff3c8d25136a7f025862caa3c23b75b74b2bae4a1c02438
Instruction ID: c552d82dd698fb35549e749a6f2c2ef28d1e8fdc14a6df10f40b70e623b0d293
Opcode Fuzzy Hash: 602290d42e7350694ff3c8d25136a7f025862caa3c23b75b74b2bae4a1c02438
Instruction Fuzzy Hash: 0E41EDB294034CABEF26FFA1DC49EEE3BADFB08304F14482AB91592151EB71D5558F60

Function 02782DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,02782F0F,?,027820FF,02792000), ref: 02782E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,02782F0F,?,027820FF,02792000), ref: 02782E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 02782E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,02782F0F,?,027820FF,02792000), ref: 02782E4C
HeapAlloc.KERNEL32(00000000,?,00000000,02782F0F,?,027820FF,02792000), ref: 02782E4F
htons.WS2_32(00000035), ref: 02782E88
inet_addr.WS2_32(?), ref: 02782E93
gethostbyname.WS2_32(?), ref: 02782EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,02782F0F,?,027820FF,02792000), ref: 02782EE3
HeapFree.KERNEL32(00000000,?,00000000,02782F0F,?,027820FF,02792000), ref: 02782EE6

Strings

iphlpapi.dll, xrefs: 02782DFB, 02782E00, 02782E10
GetNetworkParams, xrefs: 02782E28

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 9dd68a7e83e5b322bc066d47139778391872bf59a2a9fd4ab7fe77dfab42aada
Instruction ID: d264ffe087f8c6b6d20bd740e96fc80d05cc96c86784fe7acfb5580955a78324
Opcode Fuzzy Hash: 9dd68a7e83e5b322bc066d47139778391872bf59a2a9fd4ab7fe77dfab42aada
Instruction Fuzzy Hash: 1131F433E8034AABDF10ABB8984CB6F7BB8AF04326F144555FD14E3291DB30C5428B58

Function 02789326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,02789DD7,?,00000022,?,?,00000000,00000001), ref: 02789340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,02789DD7,?,00000022,?,?,00000000,00000001), ref: 0278936E
GetModuleFileNameA.KERNEL32(00000000,?,02789DD7,?,00000022,?,?,00000000,00000001), ref: 02789375
wsprintfA.USER32 ref: 027893CE
wsprintfA.USER32 ref: 0278940C
wsprintfA.USER32 ref: 0278948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 027894F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02789526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02789571

Strings

runas, xrefs: 02789674

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: e3fb6f2079a17a953d0e670be98eb676eba1b75e425a542932d9988c6327d97a
Instruction ID: f560d3f499ea22a67de6ec50bb15d95ed2c5ae37e37b7ce279583aaba1f68f6c
Opcode Fuzzy Hash: e3fb6f2079a17a953d0e670be98eb676eba1b75e425a542932d9988c6327d97a
Instruction Fuzzy Hash: 70A19FB29C0248EFEB21AFA0CC49FEE3BADEB04741F104026FA05A2251D771D555CFA1

Function 0278B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0278B467

Part of subcall function 0278EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0278EF92
Part of subcall function 0278EF7C: lstrlenA.KERNEL32(?), ref: 0278EF99
Part of subcall function 0278EF7C: lstrlenA.KERNEL32(00000000), ref: 0278EFA0

Strings

%DATE, xrefs: 0278B4D2
%P5DATE, xrefs: 0278B4F2
%TO_EMAIL, xrefs: 0278B473
%TO_USER, xrefs: 0278B488
%FROM_EMAIL, xrefs: 0278B3E9
%TO_HASH, xrefs: 0278B4B0
%M5DATE, xrefs: 0278B50F
%FROM_DOMAIN, xrefs: 0278B41E
%FROM_USER, xrefs: 0278B431
%s@%s, xrefs: 0278B461
%TO_DOMAIN, xrefs: 0278B44B

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 9da28072a57cb6508f41dcc9b58f0b999c0ab1befe9a35e021c3cf75f243f7b6
Instruction ID: e993bed9f8f102cbcdb622a30a37ca271a07cd23f9fe61b0d1b9b65fc9f8ffee
Opcode Fuzzy Hash: 9da28072a57cb6508f41dcc9b58f0b999c0ab1befe9a35e021c3cf75f243f7b6
Instruction Fuzzy Hash: 6D414FF25812197FEF02BAA4DCC5CFF7F6DEF4A648F140425FA05A2000DB31AA148BA1

Function 02782011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02782078
GetTickCount.KERNEL32 ref: 027820D4
GetTickCount.KERNEL32 ref: 027820DB
GetTickCount.KERNEL32 ref: 0278212B
GetTickCount.KERNEL32 ref: 02782132
GetTickCount.KERNEL32 ref: 02782142

Part of subcall function 0278F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0278E342,00000000,7508EA50,80000001,00000000,0278E513,?,00000000,00000000,?,000000E4), ref: 0278F089
Part of subcall function 0278F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0278E342,00000000,7508EA50,80000001,00000000,0278E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0278F093

Part of subcall function 0278E854: lstrcpyA.KERNEL32(00000001,?,?,0278D8DF,00000001,localcfg,except_info,00100000,02790264), ref: 0278E88B
Part of subcall function 0278E854: lstrlenA.KERNEL32(00000001,?,0278D8DF,00000001,localcfg,except_info,00100000,02790264), ref: 0278E899

Part of subcall function 02781C5F: wsprintfA.USER32 ref: 02781CE1

Strings

rbl_ip, xrefs: 0278218F
rbl_bl, xrefs: 02782181
net_type, xrefs: 027821DF
localcfg, xrefs: 02782070, 02782160, 02782186, 02782194, 027821E4

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 945a7dadd80a57d5765c6d6d0cff7a5b04f9b344056ee2c165f342ff4e5f6518
Instruction ID: f4c38e528d983eee755f36722ff84c5e956a3f3d631a1edb7a423f6c080c46c2
Opcode Fuzzy Hash: 945a7dadd80a57d5765c6d6d0cff7a5b04f9b344056ee2c165f342ff4e5f6518
Instruction Fuzzy Hash: 95512370EC5385AEE729FF34ED49B673BE5AB00315F11481EEE05C6193DBB490AACA11

Function 0278C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0278A4C7: GetTickCount.KERNEL32 ref: 0278A4D1
Part of subcall function 0278A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0278A4FA

GetTickCount.KERNEL32 ref: 0278C31F
GetTickCount.KERNEL32 ref: 0278C32B
GetTickCount.KERNEL32 ref: 0278C363
GetTickCount.KERNEL32 ref: 0278C378
GetTickCount.KERNEL32 ref: 0278C44D
InterlockedIncrement.KERNEL32(0278C4E4), ref: 0278C4AE
CreateThread.KERNEL32(00000000,00000000,0278B535,00000000,?,0278C4E0), ref: 0278C4C1
CloseHandle.KERNEL32(00000000,?,0278C4E0,02793588,02788810), ref: 0278C4CC

Strings

localcfg, xrefs: 0278C2DD

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 0e2c65c642e51c2c66b817074fecfe09bcdb8240c17547d91a49dcdf6ee8b958
Instruction ID: 7ffae6886f7370753727f4202a6376e1a209cca37df66e2ff5b9edbcfc6ba75e
Opcode Fuzzy Hash: 0e2c65c642e51c2c66b817074fecfe09bcdb8240c17547d91a49dcdf6ee8b958
Instruction Fuzzy Hash: FD518BB1A80B418FC729AF69C58462ABBE9FB48304B505D3ED18BC7A90D774F845CB24

Function 0278BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0278BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0278BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0278BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0278BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0278BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0278BF94

Strings

smtp_retr, xrefs: 0278BE61, 0278BF8C
smtp_herr, xrefs: 0278BE46, 0278BF62
smtp_ban, xrefs: 0278BE55, 0278BF77

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: fae312d843ff7d99aa7ce4872d0a39c7f83ea505fd2471a4e83105079fed2afa
Instruction ID: 1f9d62bd323899a2f3d8f9ce6b4eedc097bb1ebcedd232200c3a7f0569785020
Opcode Fuzzy Hash: fae312d843ff7d99aa7ce4872d0a39c7f83ea505fd2471a4e83105079fed2afa
Instruction Fuzzy Hash: CC51E371A8031AEFDF11AF69D884B6EBBA9AF0634CF006055E945EB210D730E955CF90

Function 02786A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,02789A60,?,?,02789E9D), ref: 02786A7D
GetDiskFreeSpaceA.KERNEL32(02789E9D,02789A60,?,?,?,027922F8,?,?,?,02789A60,?,?,02789E9D), ref: 02786ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,02789A60,?,?,02789E9D), ref: 02786B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02789A60,?,?,02789E9D), ref: 02786B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02789A60,?,?,02789E9D), ref: 02786B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,02789A60,?,?,02789E9D), ref: 02786B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02789A60,?,?,02789E9D), ref: 02786B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,02789A60,?,?,02789E9D), ref: 02786B80
GetLastError.KERNEL32(?,?,?,02789A60,?,?,02789E9D,?,?,?,?,?,02789E9D,?,00000022,?), ref: 02786B96

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: ab2e37e49f25115f41fefe419ea8bfe7714268e3886dccb28524175e87798842
Instruction ID: 8c95dfd2258e808b291e84b29cfcfee72f74b450efdf315c91d4058948f51095
Opcode Fuzzy Hash: ab2e37e49f25115f41fefe419ea8bfe7714268e3886dccb28524175e87798842
Instruction Fuzzy Hash: 753192B2D8124DBFDB01BFA48844EDE7F7EEF44314F248866E651A3241D73099668F61

Function 02786F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0278D7C3), ref: 02786F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0278D7C3), ref: 02786FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 02786FE8
LocalFree.KERNEL32(00000120), ref: 0278701F
wsprintfA.USER32 ref: 02787036

Strings

|, xrefs: 02786FB3
/%d, xrefs: 02787030

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 2f8b5872ede5e0607ffd9fc8bf32912df585262d41c0da017a88a9b32eec98aa
Instruction ID: 27366ce964aec55d4be236fd19977e86afb3ca4917b8ed41cd6ebada33d58226
Opcode Fuzzy Hash: 2f8b5872ede5e0607ffd9fc8bf32912df585262d41c0da017a88a9b32eec98aa
Instruction Fuzzy Hash: 5F311876940208BBDB01EFA8D849ADE7BBCEF05354F148066F959DB200EB35D6088B94

Function 02786CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,027922F8,000000E4,02786DDC,000000C8), ref: 02786CE7
GetProcAddress.KERNEL32(00000000), ref: 02786CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02786D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02786D2B

Strings

GetSystemWow64DirectoryA, xrefs: 02786CDD
C:\Windows\SysWOW64\, xrefs: 02786CC9, 02786CD1, 02786CFE, 02786D05, 02786D13, 02786D1E, 02786D2A, 02786D42, 02786D5F, 02786D85
kernel32, xrefs: 02786CE2

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 892a3a4fe3393eb02803a709fd72fc6c13ac76aa2e9c37faaa4ed76038a05c71
Instruction ID: 8c59f528ac806ec56774345c02e0ccb4ea140d5cdea788272ba63906bcf85429
Opcode Fuzzy Hash: 892a3a4fe3393eb02803a709fd72fc6c13ac76aa2e9c37faaa4ed76038a05c71
Instruction Fuzzy Hash: 7621F3A2AC53547AFF227637ACCDF6B3E9D8B42744F098444FC04A6182EBA5844686B5

Function 0278977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02789947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,027922F8), ref: 027897B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,027922F8), ref: 027897EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,027922F8), ref: 027897F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,027922F8), ref: 02789831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,027922F8), ref: 0278984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,027922F8), ref: 0278985B

Strings

D, xrefs: 027897A9

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 604ba01952b6de1de627452906800328e8734ebd583c2f78a06989c027f89352
Instruction ID: 5fcdc2b6efa995b8cfe5c7c7a2f184553e3ed22f9739fe1ab5acaa01d3a9a51f
Opcode Fuzzy Hash: 604ba01952b6de1de627452906800328e8734ebd583c2f78a06989c027f89352
Instruction Fuzzy Hash: 5C211D71D8121ABBDB21AFA1DC49FEF7BBCEF05654F004461BA19E1150EB309654CEA0

Function 0278E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0278DD05: GetTickCount.KERNEL32 ref: 0278DD0F
Part of subcall function 0278DD05: InterlockedExchange.KERNEL32(027936B4,00000001), ref: 0278DD44
Part of subcall function 0278DD05: GetCurrentThreadId.KERNEL32 ref: 0278DD53

Part of subcall function 0278DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0278DDB5

lstrcpynA.KERNEL32(?,02781E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0278EAAA,?,?), ref: 0278E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0278EAAA,?,?,00000001,?,02781E84,?), ref: 0278E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0278EAAA,?,?,00000001,?,02781E84,?,0000000A), ref: 0278E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0278EAAA,?,?,00000001,?,02781E84,?), ref: 0278E94F

Strings

flags_upd, xrefs: 0278E8A7
localcfg, xrefs: 0278E8AB

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 527cb19ba0f7746ce4d0d4ecdf898cd188ce2aa6e9ce2c52c3cd226b1e7f51d6
Instruction ID: 0a9d70ab612850e1dee67f2a0798664b53118049d1e04a40798a75d02bdab5b8
Opcode Fuzzy Hash: 527cb19ba0f7746ce4d0d4ecdf898cd188ce2aa6e9ce2c52c3cd226b1e7f51d6
Instruction Fuzzy Hash: 37511D72D4020AAFDB11EFA8C984DAEBBF9FF48304F14456AE405A7250E775EA158F60

Function 02786BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02786BB2

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: b629d72d5284b9d2d9cfa025d6bfb1a6d03f2150343a860a3df02c18ba4dbc84
Instruction ID: b0a19ab1e8a0fb79272739730230ccfc22e8002655bbc1040fe30accd610c896
Opcode Fuzzy Hash: b629d72d5284b9d2d9cfa025d6bfb1a6d03f2150343a860a3df02c18ba4dbc84
Instruction Fuzzy Hash: 9E219076986215FFDB117BB4ED89DAF3FADDB04364B108815F602E1080EB31EA11DA74

Function 02789064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,027922F8), ref: 0278907B
wsprintfA.USER32 ref: 027890E9
CreateFileA.KERNEL32(027922F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0278910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02789122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0278912D
CloseHandle.KERNEL32(00000000), ref: 02789134

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 05016cd430bf0129aca9ca4028d0beb0238e28bf179ee38a25b41865998a0d78
Instruction ID: 7a307235ea76371efb6209530cd3d3e380f5bf802a09806f1199c3f316ffa9f9
Opcode Fuzzy Hash: 05016cd430bf0129aca9ca4028d0beb0238e28bf179ee38a25b41865998a0d78
Instruction Fuzzy Hash: EB1187F2AC02147BFB257676DC0DEAF366FDFC4701F00C465BB0AA5140EA704A128A64

Function 0278DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0278DD0F
GetCurrentThreadId.KERNEL32 ref: 0278DD20
GetTickCount.KERNEL32 ref: 0278DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0278E538,?,75920F10,?,00000000,?,0278A445), ref: 0278DD3B
InterlockedExchange.KERNEL32(027936B4,00000001), ref: 0278DD44
GetCurrentThreadId.KERNEL32 ref: 0278DD53

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 8bdee18c0a2ef84cb406f4ccc97ac51b43df508ddab4c258a2f2d1819eb33d12
Instruction ID: 3215e054907aa6197062688ce58264c02a98f6df45ccf48cd6ee13b2ab950c55
Opcode Fuzzy Hash: 8bdee18c0a2ef84cb406f4ccc97ac51b43df508ddab4c258a2f2d1819eb33d12
Instruction Fuzzy Hash: 2FF082739D83049FDB906B7AA888B297BB9E745312F008856E509C2281E7305467CF72

Function 0278AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0278AD1C
lstrlenA.KERNEL32(00000000), ref: 0278AD60
lstrlenA.KERNEL32(00000000), ref: 0278AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0278AD7F

Strings

LocalHost, xrefs: 0278AD79

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 44f70945f0e692890b10a9e60783020fb292bc619806af4b7d102f9144bb21e3
Instruction ID: a828bc381aaec37a41d3210657786d113ed86a892feaf5c5d8e15f40ead1b26a
Opcode Fuzzy Hash: 44f70945f0e692890b10a9e60783020fb292bc619806af4b7d102f9144bb21e3
Instruction Fuzzy Hash: 1501F520CC42895DDF32663E9848BB53F66AB8670AF505097E4C0DB11DFF64808787B2

Function 02784BD1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02784BDD
GetTickCount.KERNEL32 ref: 02784BEC
Sleep.KERNEL32(00000000,?,%FROM_EMAIL,02785D02,00000000,?,0278B85C,?,00000080,?,00000000,00000000,?,%FROM_EMAIL), ref: 02784BF9
InterlockedExchange.KERNEL32(02C1B160,00000001), ref: 02784C02

Strings

%FROM_EMAIL, xrefs: 02784BD1

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID: %FROM_EMAIL
API String ID: 2207858713-2903620461
Opcode ID: 9352bc32f6fa63a3a8b7561b06a5aaa473ae63f4f995d7c088ae53c5dde8d293
Instruction ID: 219c75db32ad4e1cae7679c0e70ae83f2e43aceed8b99e9bca82871fdca3e257
Opcode Fuzzy Hash: 9352bc32f6fa63a3a8b7561b06a5aaa473ae63f4f995d7c088ae53c5dde8d293
Instruction Fuzzy Hash: E4E0CD376D131557C71037BE5C84F56779CDB45361F064472F708D2140C5E6946241B5

Function 02784280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,027898FD,00000001,00000100,027922F8,0278A3C7), ref: 02784290
CloseHandle.KERNEL32(0278A3C7), ref: 027843AB
CloseHandle.KERNEL32(00000001), ref: 027843AE

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: f9ab18204e088d4fb5a92803502663966be79fb6eff29c3954e38a8bedb958ef
Instruction ID: 27ee121ae3e18fb2737802d6e680692a8fa80a0624978cdf9dfe9a92bc43e5cf
Opcode Fuzzy Hash: f9ab18204e088d4fb5a92803502663966be79fb6eff29c3954e38a8bedb958ef
Instruction Fuzzy Hash: C34189B1C8020ABADB22BBA5DD89FAFBFB9EF41324F104555F614B2180D7748651CBA0

Function 02786069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0278609C
LoadLibraryA.KERNEL32(?,?,027864CF,00000000), ref: 027860C3
GetProcAddress.KERNEL32(?,00000014), ref: 0278614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0278619E

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: e569700ada756262bcfcbcfc7535d8cd39538fdb6062b93f3c5f1ed11af27c43
Instruction ID: 0e9068ec1ca42eed11b750763c58c465d1f7b71d84c412c7cd5c9d12d3f374bd
Opcode Fuzzy Hash: e569700ada756262bcfcbcfc7535d8cd39538fdb6062b93f3c5f1ed11af27c43
Instruction Fuzzy Hash: EA414971E9020ABFDB14EF58C884B79B7B9EF04358F248169E815E7292E730E955CB90

Function 02782923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f3363b31bfe67e9e02e43dba86e7cea58f49f365378502bd4918db28bd91039
Instruction ID: 3c11910484ce6ce2896a562fd130e5242cb86105feba2444adc1a43305394560
Opcode Fuzzy Hash: 0f3363b31bfe67e9e02e43dba86e7cea58f49f365378502bd4918db28bd91039
Instruction Fuzzy Hash: 0C31A072A80308ABDB21AFA9CC85BBEB7F4FF48702F108456ED04E6242E374D641CB55

Function 027826FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0278272E
htons.WS2_32(00000001), ref: 02782752
htons.WS2_32(0000000F), ref: 027827D5
htons.WS2_32(00000001), ref: 027827E3
sendto.WS2_32(?,02792BF8,00000009,00000000,00000010,00000010), ref: 02782802

Part of subcall function 0278EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0278EBFE,7FFF0001,?,0278DB55,7FFF0001), ref: 0278EBD3
Part of subcall function 0278EBCC: RtlAllocateHeap.NTDLL(00000000,?,0278DB55,7FFF0001), ref: 0278EBDA

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: d9dc47aa10342436f570654099cad92a0933e6781f463286ec750b90b6b1cded
Instruction ID: cba2da7e23afb512a6ff477613a19c42776212539ff872bfd592dd5d8085a8e4
Opcode Fuzzy Hash: d9dc47aa10342436f570654099cad92a0933e6781f463286ec750b90b6b1cded
Instruction Fuzzy Hash: 373126346C0382AFD710BF75D881AA577A0EF19328B19845DED558B313E6329493CB50

Function 02789145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,027922F8), ref: 0278915F
GetModuleFileNameA.KERNEL32(00000000), ref: 02789166
CharToOemA.USER32(?,?), ref: 02789174
wsprintfA.USER32 ref: 027891A9

Part of subcall function 02789064: GetTempPathA.KERNEL32(00000400,?,00000000,027922F8), ref: 0278907B
Part of subcall function 02789064: wsprintfA.USER32 ref: 027890E9
Part of subcall function 02789064: CreateFileA.KERNEL32(027922F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0278910E
Part of subcall function 02789064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02789122
Part of subcall function 02789064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0278912D
Part of subcall function 02789064: CloseHandle.KERNEL32(00000000), ref: 02789134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 027891E1

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 029e2e72e133c0002ec18020f8ede405e01fb658278d3f83f51d49bdedc738d6
Instruction ID: 28aa7ede52c37c4e2e532736a8a1a74034378001014ee7d2040f5977c43c9771
Opcode Fuzzy Hash: 029e2e72e133c0002ec18020f8ede405e01fb658278d3f83f51d49bdedc738d6
Instruction Fuzzy Hash: 550152F7D80258BBEB21A6619D4DFEF7B7CDB95701F000492BB49E2040D67096958F70

Function 02782419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,02782491,?,?,?,0278E844,-00000030,?,?,?,00000001), ref: 02782429
lstrlenA.KERNEL32(?,?,02782491,?,?,?,0278E844,-00000030,?,?,?,00000001,02781E3D,00000001,localcfg,lid_file_upd), ref: 0278243E
lstrcmpiA.KERNEL32(?,?), ref: 02782452
lstrlenA.KERNEL32(?,?,02782491,?,?,?,0278E844,-00000030,?,?,?,00000001,02781E3D,00000001,localcfg,lid_file_upd), ref: 02782467

Strings

localcfg, xrefs: 0278241F

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 7ba272c3479ea1dbbf42ee03e3c6e85bdf155e92197ef2afd09202bfd503bc05
Instruction ID: b4e57a26d18b7cc5c50b1a53800ecc8d943fe819e0a113d421318dd5a28d413b
Opcode Fuzzy Hash: 7ba272c3479ea1dbbf42ee03e3c6e85bdf155e92197ef2afd09202bfd503bc05
Instruction Fuzzy Hash: 6C011A72600258AFCF11FF69CC849DE7BA9EF44395B01C425EC59A7202E330EE518AA4

Function 02781C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02781CE1
wsprintfA.USER32 ref: 02781D6B

Strings

%u.%u.%u.%u.%s, xrefs: 02781CDB, 02781D65
localcfg, xrefs: 02781C70

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: f41890d17e3496cdf4e96706b605197264a5131c02a74a0c21e043d375f1229d
Instruction ID: 0e5a98abd7f57369c98f1e0d34a7d270cbed417fc17a7ef67cf6f92e4fce7aee
Opcode Fuzzy Hash: f41890d17e3496cdf4e96706b605197264a5131c02a74a0c21e043d375f1229d
Instruction Fuzzy Hash: 14419C729042989FDB22EF798C44BEE3BE99F49310F240056FDA4D3141E634DA05CFA0

Function 0278E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0278DD05: GetTickCount.KERNEL32 ref: 0278DD0F
Part of subcall function 0278DD05: InterlockedExchange.KERNEL32(027936B4,00000001), ref: 0278DD44
Part of subcall function 0278DD05: GetCurrentThreadId.KERNEL32 ref: 0278DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,02785EC1), ref: 0278E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,02785EC1), ref: 0278E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,75920F10,00000000,?,02785EC1), ref: 0278E722

Strings

89ABCDEF, xrefs: 0278E721

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 34a76be5095d5047ae60df3a90621f3fe2a9ff85f7f39ec03604d4cce6505a59
Instruction ID: c1424c1115de9bca9125079859baeac9e1f99e3c23ee36022b8c254d6981eef7
Opcode Fuzzy Hash: 34a76be5095d5047ae60df3a90621f3fe2a9ff85f7f39ec03604d4cce6505a59
Instruction Fuzzy Hash: 3B31CD31A80706EBCF31AF65D888B6A77E4FB01724F10882AF95587592E770E884CB91

Function 0278E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0278E2A3,00000000,00000000,00000000,00020106,00000000,0278E2A3,00000000,000000E4), ref: 0278E0B2
RegSetValueExA.ADVAPI32(0278E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,027922F8), ref: 0278E127
RegDeleteValueA.ADVAPI32(0278E2A3,?,?,?,?,?,000000C8,027922F8), ref: 0278E158
RegCloseKey.ADVAPI32(0278E2A3,?,?,?,?,000000C8,027922F8,?,?,?,?,?,?,?,?,0278E2A3), ref: 0278E161

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 1b27eafc3e707b2432273df8926bd835b04f2e46dd34846679b23adfaadaa690
Instruction ID: 6c77c1d6d65aac7f092233941276fc8ed02373d5940356e81c3dd47f8f3bf547
Opcode Fuzzy Hash: 1b27eafc3e707b2432273df8926bd835b04f2e46dd34846679b23adfaadaa690
Instruction Fuzzy Hash: C3217172E40219BBDF21AEA8DC89EEF7FB9EF09750F108061F904E6150E7318A55CB91

Function 02783F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0278A3C7,00000000,00000000,000007D0,00000001), ref: 02783F44
GetLastError.KERNEL32 ref: 02783F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 02783F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02783F72

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 05fdffb23758aab9b20a1ea206326036adfeb6afdabe94986f6142ebbb5ed34d
Instruction ID: 62f3b4e7dcabcd562342cb0c00306df7ed2fec8296a2f717ee4efa8894844128
Opcode Fuzzy Hash: 05fdffb23758aab9b20a1ea206326036adfeb6afdabe94986f6142ebbb5ed34d
Instruction Fuzzy Hash: 0201E572951219ABDF01EE98DD84BEF7BBCEB04756F104465FA01E2040D734DA258BB2

Function 02783F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0278A3C7,00000000,00000000,000007D0,00000001), ref: 02783FB8
GetLastError.KERNEL32 ref: 02783FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 02783FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02783FE6

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: ca6105fbcd84cec39f64aebc947b982d09e057501a0ca92aa80665ffec56ad63
Instruction ID: 564f5e5e6bbe3d90e088e5228cdbcb0e1015fed4e261bd2353235681b816b47f
Opcode Fuzzy Hash: ca6105fbcd84cec39f64aebc947b982d09e057501a0ca92aa80665ffec56ad63
Instruction Fuzzy Hash: F401E97296021AABDF11EF98D945BEE7B7CEB04755F004451F902E2040DB70DA65CBB1

Function 0278A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0278A4D1
GetTickCount.KERNEL32 ref: 0278A4E4
Sleep.KERNEL32(00000000,?,0278C2E9,0278C4E0,00000000,localcfg,?,0278C4E0,02793588,02788810), ref: 0278A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0278A4FA

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 8589642f376a8ed5afbb3a3103345c190a3e0e338ae19d04c6b0b23b49dc3d24
Instruction ID: 17fdd98222987da25c20524fbd9c70880c7c327aaa7115f4ca5f6bffb9419160
Opcode Fuzzy Hash: 8589642f376a8ed5afbb3a3103345c190a3e0e338ae19d04c6b0b23b49dc3d24
Instruction Fuzzy Hash: AEE07D332C031557CF0037ADAC84F6A33C8EB49771F014432FF08E3140D62AA46281B2

Function 02784E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02784E9E
GetTickCount.KERNEL32 ref: 02784EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 02784EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 02784EC3

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: b8ff62e8eb42b777b0ee27fc1b88991b27df2f66b506a7aba3f4ebdee7d45bf9
Instruction ID: 3603bbc6744850164f25b144bb14c35124ad743fbd2e0ec5caefc8f7b0cfcd11
Opcode Fuzzy Hash: b8ff62e8eb42b777b0ee27fc1b88991b27df2f66b506a7aba3f4ebdee7d45bf9
Instruction Fuzzy Hash: A5E0863369131557D61036BEAC84F5766499B45371F010931E609D2180D6A6946345B1

Function 027830FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02783103
GetTickCount.KERNEL32 ref: 0278310F
Sleep.KERNEL32(00000000), ref: 0278311C
InterlockedExchange.KERNEL32(?,00000001), ref: 02783128

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: cb4d152b4a72e3851998e4dbdc8d1127478143604bb646591823d6c723ef5f15
Instruction ID: fa4323f042f96b2714bdc758e79b73b5928ee1dd776cb289b1b3bdfee6c6645b
Opcode Fuzzy Hash: cb4d152b4a72e3851998e4dbdc8d1127478143604bb646591823d6c723ef5f15
Instruction Fuzzy Hash: 50E0C231A90315ABDB007B7DAD44F696A5ADF84F61F014871F205E6090C66048228971

Function 02788CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02788D02
GetTickCount.KERNEL32 ref: 02788DA1

Strings

localcfg, xrefs: 02788D19

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: bd903e8525bdb99013477e1f2b2c2c0e16fb1d974c8e9672b9906f7275a4e033
Instruction ID: a0071f51b0c81385e2036ac7b58232e7657d48681769dd2d52e2d47673643ee2
Opcode Fuzzy Hash: bd903e8525bdb99013477e1f2b2c2c0e16fb1d974c8e9672b9906f7275a4e033
Instruction Fuzzy Hash: 19212C32A9061DAFCB10FF7AC8C465A77B9FF24314B654599D401DB201EB30E951CB71

Function 0278BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0278BFD0
wsprintfA.USER32 ref: 0278C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0278C057

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 26baacb566564c53aba323cbce445e823a68884c4aef6d8353fa10693081f008
Instruction ID: cc23ae49e33369cdd03517cc7b5c8ae7fc42f335cad67cd88dc719b5aba05292
Opcode Fuzzy Hash: 26baacb566564c53aba323cbce445e823a68884c4aef6d8353fa10693081f008
Instruction Fuzzy Hash: 21119772500200FFDB429AA9DD44E567FA6FF88318B34819CF6188E126D633D863EB50

Function 027838F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 027830FA: GetTickCount.KERNEL32 ref: 02783103
Part of subcall function 027830FA: InterlockedExchange.KERNEL32(?,00000001), ref: 02783128

GetCurrentThreadId.KERNEL32 ref: 02783929
GetCurrentThreadId.KERNEL32 ref: 02783939

Strings

%FROM_EMAIL, xrefs: 02783913

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: d3d111fad18be27dd3e7613f518123a2f3396e056e94240f26866810fa5f872f
Instruction ID: d35d1fff6a8114219cc1c780ab57e23db4a44043f29a6a96ad93345076ecfe91
Opcode Fuzzy Hash: d3d111fad18be27dd3e7613f518123a2f3396e056e94240f26866810fa5f872f
Instruction Fuzzy Hash: E4114C71980214EFDB21EF19D485A5CF3F5FB05B1AF10899EEC4497281D774AA81CFA0

Function 0278AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0278BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0278ABB9
InterlockedIncrement.KERNEL32(02793640), ref: 0278ABE1

Strings

%FROM_EMAIL, xrefs: 0278AB8C

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 63b2f1f8792a6f214615312c5ab3ccc0f73e4357d0e7dd8883c547392b9e8d89
Instruction ID: e198c9ea5a8ca3e4198032a2ef7018d8ce008ca5fc32b950349fac211e28c3e8
Opcode Fuzzy Hash: 63b2f1f8792a6f214615312c5ab3ccc0f73e4357d0e7dd8883c547392b9e8d89
Instruction Fuzzy Hash: 9501BC719883C4AFEB12DF18D885F967FA6AF15354F144886F9808B203C3B0E995CBA1

Function 027826B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 027826C3
inet_ntoa.WS2_32(?), ref: 027826E4

Strings

localcfg, xrefs: 027826CD, 027826D2, 027826DE

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: e6ebd1dc27a98f795027b8f682929d65dd49c8bef62131705a2df7a24d4d007a
Instruction ID: 27c6a133ea2f92c765274594ca92b6de91ea2786d67f3851d85e4b6846dac745
Opcode Fuzzy Hash: e6ebd1dc27a98f795027b8f682929d65dd49c8bef62131705a2df7a24d4d007a
Instruction Fuzzy Hash: E3F082762982087BEB007EA0EC09AAA379CDF05651F148421F908DA090DB71D9508798

Function 0278EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0278EB54,_alldiv,0278F0B7,80000001,00000000,00989680,00000000,?,?,?,0278E342,00000000,7508EA50,80000001,00000000), ref: 0278EAF2
GetProcAddress.KERNEL32(76E80000,00000000), ref: 0278EB07

Strings

ntdll.dll, xrefs: 0278EAED

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: babe5993afb2f6a25cc20c15ad8d47edc71d4e8e638c684330d1ee74337026f1
Instruction ID: 787987fc38d6a608b9a2bf5932d1c23836e0d4faf82a270a04f29064322f53ee
Opcode Fuzzy Hash: babe5993afb2f6a25cc20c15ad8d47edc71d4e8e638c684330d1ee74337026f1
Instruction Fuzzy Hash: E7D0C975AD03029BDF125FA9AA0BE0A7AE8AB40701B80C855B40AD1200E730D425DA00

Function 02782F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02782D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,02782F01,?,027820FF,02792000), ref: 02782D3A
Part of subcall function 02782D21: LoadLibraryA.KERNEL32(?), ref: 02782D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02782F73
HeapFree.KERNEL32(00000000), ref: 02782F7A

Memory Dump Source

Source File: 0000000D.00000002.3322693743.0000000002780000.00000040.00000400.00020000.00000000.sdmp, Offset: 02780000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2780000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 430ba8a9a7062cb95210c8bbc5abad67c87bac171660c09eb928bce5b6ee1271
Instruction ID: 59f975d0060c0d99fdb138d7308d63efaa253cec55ae27a18042668ed3e0cc5e
Opcode Fuzzy Hash: 430ba8a9a7062cb95210c8bbc5abad67c87bac171660c09eb928bce5b6ee1271
Instruction Fuzzy Hash: 9C51907194024A9FDF02AF64D888AF9B7B6FF06305F1045A9EC96D7211E7329A19CF90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report H3nfKrgQbi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\wuefhdgm.exe

C:\Windows\SysWOW64\bazwewbz\wuefhdgm.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
H3nfKrgQbi.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre